CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2017-5095 – chromium-browser: out-of-bounds write in pdfium
https://notcve.org/view.php?id=CVE-2017-5095
Stack overflow in PDFium in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to potentially exploit stack corruption via a crafted PDF file. Un desbordamiento de pila en PDFium en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Linux, Windows y Mac, permitía que un atacante remoto explotase una corrupción de pila mediante un archivo PDF manipulado. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/732661 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5095 https://bugzilla.redhat.com/show_bug.cgi?id=1475197 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2017-5110 – chromium-browser: ui spoofing in payments dialog
https://notcve.org/view.php?id=CVE-2017-5110
Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page. Una implementación incorrecta de la API de pagos web en las combinaciones blob: y data: en Web Payments en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto suplantase el contenido de Omnibox mediante una página HTML manipulada. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/717476 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5110 https://bugzilla.redhat.com/show_bug.cgi?id=1475213 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2017-5104 – chromium-browser: ui spoofing in browser
https://notcve.org/view.php?id=CVE-2017-5104
Inappropriate implementation in interstitials in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to spoof the contents of the omnibox via a crafted HTML page. Una implementación incorrecta en interstitials en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, permitía que un atacante remoto suplantase el contenido de Omnibox mediante una página HTML manipulada. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/729105 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5104 https://bugzilla.redhat.com/show_bug.cgi?id=1475206 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2017-5094 – chromium-browser: type confusion in extensions
https://notcve.org/view.php?id=CVE-2017-5094
Type confusion in extensions JavaScript bindings in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted HTML page. Una confusión de tipos en extensions JavaScript bindings en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto pudiese modificar objetos con fines maliciosos mediante una página HTML manipulada. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/702946 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5094 https://bugzilla.redhat.com/show_bug.cgi?id=1475196 • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 8.8EPSS: 2%CPEs: 9EXPL: 0CVE-2017-5098 – chromium-browser: use after free in v8
https://notcve.org/view.php?id=CVE-2017-5098
A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Un uso de memoria previamente liberada en V8 en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto realizase una lectura de memoria fuera de límites mediante una página HTML manipulada. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/740803 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5098 https://bugzilla.redhat.com/show_bug.cgi?id=1475200 • CWE-416: Use After Free •