CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2017-5108 – chromium-browser: type confusion in pdfium
https://notcve.org/view.php?id=CVE-2017-5108
Type confusion in PDFium in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted PDF file. Una confusión de tipos en PDFium en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto pudiese modificar objetos con fines maliciosos mediante un archivo PDF manipulado. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/695830 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5108 https://bugzilla.redhat.com/show_bug.cgi?id=1475211 • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 6.5EPSS: 1%CPEs: 9EXPL: 0CVE-2017-5102 – chromium-browser: uninitialized use in skia
https://notcve.org/view.php?id=CVE-2017-5102
Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. El uso de un valor no inicializado en Skia en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto obtuviese información sensible de la memoria de procesos mediante una página HTML manipulada. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/727678 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5102 https://bugzilla.redhat.com/show_bug.cgi?id=1475204 • CWE-908: Use of Uninitialized Resource •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2017-5099 – chromium-browser: out-of-bounds write in ppapi
https://notcve.org/view.php?id=CVE-2017-5099
Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to potentially gain privilege elevation via a crafted HTML page. Validación insuficiente de entradas no fiables en PPAPI Plugins en Google Chrome en versiones anteriores a la 60.0.3112.78 para Mac permitía que un atacante remoto pudiese obtener una elevación de privilegios mediante una página HTML manipulada. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/733548 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5099 https://bugzilla.redhat.com/show_bug.cgi?id=1475201 • CWE-20: Improper Input Validation CWE-787: Out-of-bounds Write •
CVSS: 9.6EPSS: 1%CPEs: 9EXPL: 0CVE-2017-5087 – chromium-browser: sandbox escape in indexeddb
https://notcve.org/view.php?id=CVE-2017-5087
A use after free in Blink in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page, aka an IndexedDB sandbox escape. Un uso de memoria previamente liberada en Blink en Google Chrome, en versiones anteriores a la 59.0.3071.104 para Mac, Windows y Linux y a la 59.0.3071.117 para Android, permitía que un atacante remoto realizase una lectura de memoria fuera de límites mediante una página HTML manipulada. Esto también se conoce como escape de espacio aislado o sandbox IndexedDB. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99096 http://www.securitytracker.com/id/1038765 https://access.redhat.com/errata/RHSA-2017:1495 https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html https://crbug.com/725032 https://security.gentoo.org/glsa/201706-20 https://access.redhat.com/security/cve/CVE-2017-5087 https://bugzilla.redhat.com/show_bug.cgi?id=1462148 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 9EXPL: 0CVE-2017-5088 – chromium-browser: out of bounds read in v8
https://notcve.org/view.php?id=CVE-2017-5088
Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. Una validación insuficiente de entradas no fiables en V8 en Google Chrome, en versiones anteriores a la 59.0.3071.104 para Mac, Windows y Linux y a la 59.0.3071.117 para Android, permitía que un atacante remoto realizase un acceso a la memoria fuera de límites mediante una página HTML manipulada. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99096 http://www.securitytracker.com/id/1038765 https://access.redhat.com/errata/RHSA-2017:1495 https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html https://crbug.com/729991 https://security.gentoo.org/glsa/201706-20 https://access.redhat.com/security/cve/CVE-2017-5088 https://bugzilla.redhat.com/show_bug.cgi?id=1462149 • CWE-125: Out-of-bounds Read •