CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2017-5108 – chromium-browser: type confusion in pdfium
https://notcve.org/view.php?id=CVE-2017-5108
Type confusion in PDFium in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted PDF file. Una confusión de tipos en PDFium en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto pudiese modificar objetos con fines maliciosos mediante un archivo PDF manipulado. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/695830 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5108 https://bugzilla.redhat.com/show_bug.cgi?id=1475211 • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 8.8EPSS: 2%CPEs: 9EXPL: 0CVE-2017-5098 – chromium-browser: use after free in v8
https://notcve.org/view.php?id=CVE-2017-5098
A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Un uso de memoria previamente liberada en V8 en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto realizase una lectura de memoria fuera de límites mediante una página HTML manipulada. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/740803 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5098 https://bugzilla.redhat.com/show_bug.cgi?id=1475200 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-5096 – chromium-browser: user information leak via android intents
https://notcve.org/view.php?id=CVE-2017-5096
Insufficient policy enforcement during navigation between different schemes in Google Chrome prior to 60.0.3112.78 for Android allowed a remote attacker to perform cross origin content download via a crafted HTML page, related to intents. La falta de mecanismos suficientes para el cumplimiento de políticas durante la navegación entre diferentes temas en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Android, permitía que un atacante remoto realizase una descarga de cross origin content mediante una página HTML manipulada. Esto está relacionado con intents. • http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/714442 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5096 https://bugzilla.redhat.com/show_bug.cgi?id=1475198 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2017-5092 – chromium-browser: use after free in ppapi
https://notcve.org/view.php?id=CVE-2017-5092
Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Validación insuficiente de entradas no fiables en PPAPI Plugins en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Windows, permitía que un atacante remoto pudiese realizar un escape de espacio aislado o sandbox mediante una página HTML manipulada. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/733549 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5092 https://bugzilla.redhat.com/show_bug.cgi?id=1475194 • CWE-20: Improper Input Validation CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2017-5093 – chromium-browser: ui spoofing in blink
https://notcve.org/view.php?id=CVE-2017-5093
Inappropriate implementation in modal dialog handling in Blink in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to prevent a full screen warning from being displayed via a crafted HTML page. Una implementación incorrecta en la manipulación de diálogos modal en Blink en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto evitase que se mostrase una advertencia en pantalla completa mediante una página HTML manipulada. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/550017 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5093 https://bugzilla.redhat.com/show_bug.cgi?id=1475195 • CWE-20: Improper Input Validation CWE-223: Omission of Security-relevant Information •