CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-15426 – chromium-browser: url spoof in omnibox
https://notcve.org/view.php?id=CVE-2017-15426
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. Una aplicación de políticas insuficiente en Omnibox en Google Chrome en versiones anteriores a la 63.0.3239.84 permitía que un atacante remoto suplantase dominios mediante homogramas IDN en un nombre de dominio manipulado. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/756735 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2017/dsa-4064 https://access.redhat.com/security/cve/CVE-2017-15426 https://bugzilla.redhat.com/show_bug.cgi?id=1523140 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 0CVE-2017-15411 – chromium-browser: use after free in pdfium
https://notcve.org/view.php?id=CVE-2017-15411
Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Uso de memoria previamente liberada en PDFium en Google Chrome en versiones anteriores a la 63.0.3239.84 permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante un archivo PDF manipulado. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/770148 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2017/dsa-4064 https://access.redhat.com/security/cve/CVE-2017-15411 https://bugzilla.redhat.com/show_bug.cgi?id=1523127 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2017-15416 – chromium-browser: out of bounds read in blink
https://notcve.org/view.php?id=CVE-2017-15416
Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka a Blink out-of-bounds read. Desbordamiento de búfer basado en memoria dinámica (heap) en Blob API en Google Chrome en versiones anteriores a la 63.0.3239.84 permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante una página HTML manipulada. Esto también se conoce como lectura Blink fuera de límites. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/779314 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2017/dsa-4064 https://access.redhat.com/security/cve/CVE-2017-15416 https://bugzilla.redhat.com/show_bug.cgi?id=1523131 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 2%CPEs: 10EXPL: 0CVE-2017-15422 – chromium-browser: integer overflow in icu
https://notcve.org/view.php?id=CVE-2017-15422
Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Un desbordamiento de enteros en el manejo de fechas internacionales en International Components for Unicode (ICU) for C/C++ en versiones anteriores a la 60.1, tal y como se emplea en V8 en Google Chrome en versiones anteriores a la 63.0.3239.84 y otros productos, permitía que un atacante remoto realizase una lectura de memoria fuera de límites mediante una página HTML manipulada. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/774382 https://security.gentoo.org/glsa/201801-03 https://usn.ubuntu.com/3610-1 https://www.debian.org/security/2018/dsa-4150 https://access.redhat.com/security/cve/CVE-2017-15422 https://bugzilla.redhat.com/show_bug.cgi?id=1523136 • CWE-190: Integer Overflow or Wraparound •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-15424 – chromium-browser: url spoof in omnibox
https://notcve.org/view.php?id=CVE-2017-15424
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. Una aplicación de políticas insuficiente en Omnibox en Google Chrome en versiones anteriores a la 63.0.3239.84 permitía que un atacante remoto suplantase dominios mediante homogramas IDN en un nombre de dominio manipulado. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/756226 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2017/dsa-4064 https://access.redhat.com/security/cve/CVE-2017-15424 https://bugzilla.redhat.com/show_bug.cgi?id=1523138 • CWE-20: Improper Input Validation •