CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2017-15392 – chromium-browser: incorrect registry key handling in platformintegration
https://notcve.org/view.php?id=CVE-2017-15392
Insufficient data validation in V8 in Google Chrome prior to 62.0.3202.62 allowed an attacker who can write to the Windows Registry to potentially exploit heap corruption via a crafted Windows Registry entry, related to PlatformIntegration. La validación de datos insuficiente en V8 en Google Chrome, en versiones anteriores a la 62.0.3202.62, permitía que un atacante que pueda escribir en Windows Registry pudiese explotar la corrupción de la memoria dinámica (heap) mediante una entrada manipulada al Windows Registry, relacionado con PlatformIntegration. • http://www.securityfocus.com/bid/101482 https://access.redhat.com/errata/RHSA-2017:2997 https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html https://crbug.com/714401 https://security.gentoo.org/glsa/201710-24 https://www.debian.org/security/2017/dsa-4020 https://access.redhat.com/security/cve/CVE-2017-15392 https://bugzilla.redhat.com/show_bug.cgi?id=1503547 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 2%CPEs: 3EXPL: 0CVE-2017-5131 – chromium-browser: out of bounds write in skia
https://notcve.org/view.php?id=CVE-2017-5131
An integer overflow in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka an out-of-bounds write. Un desbordamiento de enteros en Skia en Google Chrome, en versiones anteriores a la 62.0.3202.62, permite que un atacante remoto explote la corrupción de la memoria dinámica (heap) mediante una página HTML manipulada. Esto también se conoce como escritura fuera de límites. • http://www.securityfocus.com/bid/101482 https://access.redhat.com/errata/RHSA-2017:2997 https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html https://crbug.com/744109 https://security.gentoo.org/glsa/201710-24 https://www.debian.org/security/2017/dsa-4020 https://access.redhat.com/security/cve/CVE-2017-5131 https://bugzilla.redhat.com/show_bug.cgi?id=1503538 • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.8EPSS: 2%CPEs: 3EXPL: 0CVE-2017-5125 – chromium-browser: heap overflow in skia
https://notcve.org/view.php?id=CVE-2017-5125
Heap buffer overflow in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un desbordamiento de búfer basado en memoria dinámica (heap) en Skia en Google Chrome, en versiones anteriores a la 62.0.3202.62, permite que un atacante remoto explote la corrupción de la memoria dinámica (heap) mediante una página HTML manipulada. • http://www.securityfocus.com/bid/101482 https://access.redhat.com/errata/RHSA-2017:2997 https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html https://crbug.com/749147 https://security.gentoo.org/glsa/201710-24 https://www.debian.org/security/2017/dsa-4020 https://access.redhat.com/security/cve/CVE-2017-5125 https://bugzilla.redhat.com/show_bug.cgi?id=1503531 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 3%CPEs: 3EXPL: 0CVE-2017-15393 – chromium-browser: referrer leak in devtools
https://notcve.org/view.php?id=CVE-2017-15393
Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugging functionality via a crafted HTML page, aka a Referer leak. La aplicación de políticas insuficiente en la depuración remota de Devtools en Google Chrome, en versiones anteriores a la 62.0.3202.62, permite que un atacante remoto obtenga acceso a la funcionalidad de depuración remota mediante una página HTML manipulada. Esto también se conoce como fuga de Referers. • http://www.securityfocus.com/bid/101482 https://access.redhat.com/errata/RHSA-2017:2997 https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html https://crbug.com/732751 https://security.gentoo.org/glsa/201710-24 https://www.debian.org/security/2017/dsa-4020 https://access.redhat.com/security/cve/CVE-2017-15393 https://bugzilla.redhat.com/show_bug.cgi?id=1503548 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2017-5127 – chromium-browser: use after free in pdfium
https://notcve.org/view.php?id=CVE-2017-5127
Use after free in PDFium in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Un uso de memoria previamente liberada en PDFium en Google Chrome, en versiones anteriores a la 62.0.3202.62, permite que un atacante remoto explote la corrupción de la memoria dinámica (heap) mediante un archivo PDF manipulado. • http://www.securityfocus.com/bid/101482 https://access.redhat.com/errata/RHSA-2017:2997 https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html https://crbug.com/765384 https://security.gentoo.org/glsa/201710-24 https://www.debian.org/security/2017/dsa-4020 https://access.redhat.com/security/cve/CVE-2017-5127 https://bugzilla.redhat.com/show_bug.cgi?id=1503533 • CWE-416: Use After Free •