CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2017-15387 – chromium-browser: content security bypass
https://notcve.org/view.php?id=CVE-2017-15387
Insufficient enforcement of Content Security Policy in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to open javascript: URL windows when they should not be allowed to via a crafted HTML page. La aplicación insuficiente de políticas de seguridad de contenidos en Blink en Google Chrome, en versiones anteriores a la 62.0.3202.62, permitía que un atacante remoto abriese ventanas javascript: URL cuando no deberían ser capaces de hacerlo mediante una página HTML manipulada. • http://www.securityfocus.com/bid/101482 https://access.redhat.com/errata/RHSA-2017:2997 https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html https://crbug.com/756040 https://security.gentoo.org/glsa/201710-24 https://www.debian.org/security/2017/dsa-4020 https://access.redhat.com/security/cve/CVE-2017-15387 https://bugzilla.redhat.com/show_bug.cgi?id=1503542 •
CVSS: 8.8EPSS: 3%CPEs: 3EXPL: 0CVE-2017-15393 – chromium-browser: referrer leak in devtools
https://notcve.org/view.php?id=CVE-2017-15393
Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugging functionality via a crafted HTML page, aka a Referer leak. La aplicación de políticas insuficiente en la depuración remota de Devtools en Google Chrome, en versiones anteriores a la 62.0.3202.62, permite que un atacante remoto obtenga acceso a la funcionalidad de depuración remota mediante una página HTML manipulada. Esto también se conoce como fuga de Referers. • http://www.securityfocus.com/bid/101482 https://access.redhat.com/errata/RHSA-2017:2997 https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html https://crbug.com/732751 https://security.gentoo.org/glsa/201710-24 https://www.debian.org/security/2017/dsa-4020 https://access.redhat.com/security/cve/CVE-2017-15393 https://bugzilla.redhat.com/show_bug.cgi?id=1503548 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 8.8EPSS: 2%CPEs: 3EXPL: 0CVE-2017-5128 – chromium-browser: heap overflow in webgl
https://notcve.org/view.php?id=CVE-2017-5128
Heap buffer overflow in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, related to WebGL. Un desbordamiento de búfer basado en memoria dinámica (heap) en Blink en Google Chrome, en versiones anteriores a la 62.0.3202.62, permite que un atacante remoto explote la corrupción de la memoria dinámica (heap) mediante una página HTML manipulada. Esto se relaciona con WebGL. • http://www.securityfocus.com/bid/101482 https://access.redhat.com/errata/RHSA-2017:2997 https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html https://crbug.com/765469 https://security.gentoo.org/glsa/201710-24 https://www.debian.org/security/2017/dsa-4020 https://access.redhat.com/security/cve/CVE-2017-5128 https://bugzilla.redhat.com/show_bug.cgi?id=1503534 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 3%CPEs: 3EXPL: 0CVE-2017-5133 – chromium-browser: out of bounds write in skia
https://notcve.org/view.php?id=CVE-2017-5133
Off-by-one read/write on the heap in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to corrupt memory and possibly leak information and potentially execute code via a crafted PDF file. Lectura/escritura por un paso en la memoria dinámica (heap) en Blink en Google Chrome en versiones anteriores a la 62.0.3202.62 permitía que un atacante remoto corrompiese la memoria y filtrase información, pudiendo ejecutar código mediante un archivo PDF manipulado. • http://www.securityfocus.com/bid/101482 https://access.redhat.com/errata/RHSA-2017:2997 https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html https://crbug.com/762106 https://security.gentoo.org/glsa/201710-24 https://www.debian.org/security/2017/dsa-4020 https://access.redhat.com/security/cve/CVE-2017-5133 https://bugzilla.redhat.com/show_bug.cgi?id=1503539 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 1%CPEs: 4EXPL: 0CVE-2017-5130 – chromium-browser: heap overflow in libxml2
https://notcve.org/view.php?id=CVE-2017-5130
An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file. Un desbordamiento de enteros en xmlmemory.c en versiones anteriores a la 2.9.5 de libxml2, tal y como se emplea en Google Chrome, en versiones anteriores a la 62.0.3202.62 y en otros productos, permite que un atacante remoto explote la corrupción de la memoria dinámica (heap) mediante un archivo XML manipulado. A heap overflow flaw was found in the libxml2 library. An application compiled with libxml2 using the vulnerable debug-only function xmlMemoryStrdup could be used by an attacker to crash the application or execute arbitrary code with the permission of the user running the application. • http://bugzilla.gnome.org/show_bug.cgi?id=783026 http://www.securityfocus.com/bid/101482 https://access.redhat.com/errata/RHSA-2017:2997 https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html https://crbug.com/722079 https://git.gnome.org/browse/libxml2/commit/?id=897dffbae322b46b83f99a607d527058a72c51ed https://lists.debian.org/debian-lts-announce/2017/11/msg00034.html https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html https://security.gentoo. • CWE-787: Out-of-bounds Write •