CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2017-5034 – chromium-browser: use after free in pdfium
https://notcve.org/view.php?id=CVE-2017-5034
A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. Un uso después de liberación en PDFium de Google Chrome versiones anteriores a 57.0.2987.98 para Linux y Windows, permitiría a un usuario remoto leer la memoria fuera de límites a través de un fichero PDF especialmente diseñado. • http://rhn.redhat.com/errata/RHSA-2017-0499.html http://www.debian.org/security/2017/dsa-3810 http://www.securityfocus.com/bid/96767 https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html https://crbug.com/678461 https://security.gentoo.org/glsa/201704-02 https://access.redhat.com/security/cve/CVE-2017-5034 https://bugzilla.redhat.com/show_bug.cgi?id=1431034 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 0CVE-2017-5045 – chromium-browser: information disclosure in xss auditor
https://notcve.org/view.php?id=CVE-2017-5045
XSS Auditor in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed detection of a blocked iframe load, which allowed a remote attacker to brute force JavaScript variables via a crafted HTML page. XSS Auditor de Google Chrome versiones anteriores a 57.0.2987.98 para Mac, Windows y Linux y versión 57.0.2987.108 para Android permiten la detección de la carga de un iframe bloqueado lo que permitiría a un atacante remoto conocer los nombre de variable de JavaScript mediante un ataque de fuerza bruta usando una página HTML especialmente diseñada. • http://rhn.redhat.com/errata/RHSA-2017-0499.html http://www.debian.org/security/2017/dsa-3810 http://www.securityfocus.com/bid/96767 https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html https://crbug.com/667079 https://security.gentoo.org/glsa/201704-02 https://access.redhat.com/security/cve/CVE-2017-5045 https://bugzilla.redhat.com/show_bug.cgi?id=1431047 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 0CVE-2017-5033 – chromium-browser: bypass of content security policy in blink
https://notcve.org/view.php?id=CVE-2017-5033
Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page, related to the unsafe-inline keyword. Blink en Google Chrome, en versiones anteriores a la 57.0.2987.98 para Mac, Windows y Linux y 57.0.2987.108 para Android, no propagaba correctamente las restricciones CSP a las páginas de temas locales, lo que permitía que un atacante remoto omitiese la política de seguridad de contenido (CSP) mediante una página HTML manipulada. Esto está relacionado con la palabra clave de unsafe-inline. • http://rhn.redhat.com/errata/RHSA-2017-0499.html http://www.debian.org/security/2017/dsa-3810 http://www.securityfocus.com/bid/96767 https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html https://crbug.com/669086 https://security.gentoo.org/glsa/201704-02 https://twitter.com/Ma7h1as/status/907641276434063361 https://access.redhat.com/security/cve/CVE-2017-5033 https://bugzilla.redhat.com/show_bug.cgi?id=1431042 • CWE-281: Improper Preservation of Permissions •
CVSS: 8.8EPSS: 1%CPEs: 11EXPL: 0CVE-2017-5037 – chromium-browser: multiple out of bounds writes in chunkdemuxer
https://notcve.org/view.php?id=CVE-2017-5037
An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer. Un desbordamiento de entero en FFmpeg de Google Chrome versiones anteriores a 57.0.2987.98 para Mac, Windows, y Linux y versión 57.0.2987.108 para Android permitiría a un atacante remoto escribir fuera de los límites de memoria a través de un archivo de vídeo especialmente diseñado. Relacionado con ChunkDemuxer. • http://rhn.redhat.com/errata/RHSA-2017-0499.html http://www.debian.org/security/2017/dsa-3810 http://www.securityfocus.com/bid/96767 https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html https://crbug.com/679640 https://security.gentoo.org/glsa/201704-02 https://access.redhat.com/security/cve/CVE-2017-5037 https://bugzilla.redhat.com/show_bug.cgi?id=1431038 • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.8EPSS: 1%CPEs: 9EXPL: 0CVE-2017-5043 – chromium-browser: use after free in guestview
https://notcve.org/view.php?id=CVE-2017-5043
Chrome Apps in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac had a use after free bug in GuestView, which allowed a remote attacker to perform an out of bounds memory read via a crafted Chrome extension. Chrome Apps de Google Chrome versiones anteriores a 57.0.2987.98 para Linux, Windows y Mac, debido a un fallo de uso después de liberación en GuestView, permitiría a un atacante remoto leer la memoria fuera de los límites a través de una extensión de Chrome especialmente diseñada. • http://rhn.redhat.com/errata/RHSA-2017-0499.html http://www.debian.org/security/2017/dsa-3810 http://www.securityfocus.com/bid/96767 https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html https://crbug.com/683523 https://security.gentoo.org/glsa/201704-02 https://access.redhat.com/security/cve/CVE-2017-5043 https://bugzilla.redhat.com/show_bug.cgi?id=1431045 • CWE-416: Use After Free •