CVSS: 8.8EPSS: 2%CPEs: 6EXPL: 0CVE-2017-5100 – chromium-browser: use after free in chrome apps
https://notcve.org/view.php?id=CVE-2017-5100
A use after free in Apps in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Un uso de memoria previamente liberada en Apps en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Windows, permitía que un atacante remoto realizase una lectura de memoria fuera de límites mediante una página HTML manipulada. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/718292 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5100 https://bugzilla.redhat.com/show_bug.cgi?id=1475202 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0CVE-2017-5101 – chromium-browser: url spoofing in omnibox
https://notcve.org/view.php?id=CVE-2017-5101
Inappropriate implementation in Omnibox in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page. Una implementación incorrecta en Omnibox en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Linux, Windows y Mac, permitía que un atacante remoto suplantase el contenido de Omnibox mediante una página HTML manipulada. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/681740 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5101 https://bugzilla.redhat.com/show_bug.cgi?id=1475203 •
CVSS: 4.3EPSS: 0%CPEs: 8EXPL: 0CVE-2017-5109 – chromium-browser: ui spoofing in browser
https://notcve.org/view.php?id=CVE-2017-5109
Inappropriate implementation of unload handler handling in permission prompts in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to display UI on a non attacker controlled tab via a crafted HTML page. Una implementación incorrecta de la gestión del manipulador de descargas en solicitudes de permisos en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Linux, Windows y Mac, permitía que un atacante remoto mostrase la interfaz de usuario en una pestaña no controlada por el atacante mediante una página HTML manipulada. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/710400 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5109 https://bugzilla.redhat.com/show_bug.cgi?id=1475212 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2017-5105 – chromium-browser: url spoofing in omnibox
https://notcve.org/view.php?id=CVE-2017-5105
Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. La falta de mecanismos suficientes para el cumplimiento de políticas en Omnibox en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto realizase una suplantación de dominio mediante homografías de IDN en un nombre de dominio manipulado. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/729979 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5105 https://bugzilla.redhat.com/show_bug.cgi?id=1475208 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2017-5097 – chromium-browser: out-of-bounds read in skia
https://notcve.org/view.php?id=CVE-2017-5097
Insufficient validation of untrusted input in Skia in Google Chrome prior to 60.0.3112.78 for Linux allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Una validación insuficiente de entradas no fiables en Skia en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Linux, permitía que un atacante remoto realizase una lectura de memoria fuera de límites mediante una página HTML manipulada. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/740789 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5097 https://bugzilla.redhat.com/show_bug.cgi?id=1475199 • CWE-20: Improper Input Validation CWE-125: Out-of-bounds Read •