CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 0CVE-2017-5033 – chromium-browser: bypass of content security policy in blink
https://notcve.org/view.php?id=CVE-2017-5033
Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page, related to the unsafe-inline keyword. Blink en Google Chrome, en versiones anteriores a la 57.0.2987.98 para Mac, Windows y Linux y 57.0.2987.108 para Android, no propagaba correctamente las restricciones CSP a las páginas de temas locales, lo que permitía que un atacante remoto omitiese la política de seguridad de contenido (CSP) mediante una página HTML manipulada. Esto está relacionado con la palabra clave de unsafe-inline. • http://rhn.redhat.com/errata/RHSA-2017-0499.html http://www.debian.org/security/2017/dsa-3810 http://www.securityfocus.com/bid/96767 https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html https://crbug.com/669086 https://security.gentoo.org/glsa/201704-02 https://twitter.com/Ma7h1as/status/907641276434063361 https://access.redhat.com/security/cve/CVE-2017-5033 https://bugzilla.redhat.com/show_bug.cgi?id=1431042 • CWE-281: Improper Preservation of Permissions •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2017-5034 – chromium-browser: use after free in pdfium
https://notcve.org/view.php?id=CVE-2017-5034
A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. Un uso después de liberación en PDFium de Google Chrome versiones anteriores a 57.0.2987.98 para Linux y Windows, permitiría a un usuario remoto leer la memoria fuera de límites a través de un fichero PDF especialmente diseñado. • http://rhn.redhat.com/errata/RHSA-2017-0499.html http://www.debian.org/security/2017/dsa-3810 http://www.securityfocus.com/bid/96767 https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html https://crbug.com/678461 https://security.gentoo.org/glsa/201704-02 https://access.redhat.com/security/cve/CVE-2017-5034 https://bugzilla.redhat.com/show_bug.cgi?id=1431034 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2017-5035 – chromium-browser: incorrect security ui in omnibox
https://notcve.org/view.php?id=CVE-2017-5035
Google Chrome prior to 57.0.2987.98 for Windows and Mac had a race condition, which could cause Chrome to display incorrect certificate information for a site. En Google Chrome versiones anteriores a 57.0.2987.98 para Windows y Mac, se ocasiona una condición de carrera que podría causar que Chrome muestre información de certificado incorrecta de un sitio. • http://rhn.redhat.com/errata/RHSA-2017-0499.html http://www.debian.org/security/2017/dsa-3810 http://www.securityfocus.com/bid/96767 https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html https://crbug.com/688425 https://security.gentoo.org/glsa/201704-02 https://access.redhat.com/security/cve/CVE-2017-5035 https://bugzilla.redhat.com/show_bug.cgi?id=1431036 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 8.8EPSS: 1%CPEs: 11EXPL: 0CVE-2017-5036 – chromium-browser: use after free in pdfium
https://notcve.org/view.php?id=CVE-2017-5036
A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to have an unspecified impact via a crafted PDF file. Un uso después de liberación en PDFium de Google Chrome versiones anteriores a 57.0.2987.98 para Mac, Windows y Linux y versión 57.0.2987.108 para Android, permitiría a un usuario remoto provocar un impacto indefinido a través de un archivo PDF especialmente diseñado. • http://rhn.redhat.com/errata/RHSA-2017-0499.html http://www.debian.org/security/2017/dsa-3810 http://www.securityfocus.com/bid/96767 https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html https://crbug.com/691371 https://security.gentoo.org/glsa/201704-02 https://access.redhat.com/security/cve/CVE-2017-5036 https://bugzilla.redhat.com/show_bug.cgi?id=1431037 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 11EXPL: 0CVE-2017-5037 – chromium-browser: multiple out of bounds writes in chunkdemuxer
https://notcve.org/view.php?id=CVE-2017-5037
An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer. Un desbordamiento de entero en FFmpeg de Google Chrome versiones anteriores a 57.0.2987.98 para Mac, Windows, y Linux y versión 57.0.2987.108 para Android permitiría a un atacante remoto escribir fuera de los límites de memoria a través de un archivo de vídeo especialmente diseñado. Relacionado con ChunkDemuxer. • http://rhn.redhat.com/errata/RHSA-2017-0499.html http://www.debian.org/security/2017/dsa-3810 http://www.securityfocus.com/bid/96767 https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html https://crbug.com/679640 https://security.gentoo.org/glsa/201704-02 https://access.redhat.com/security/cve/CVE-2017-5037 https://bugzilla.redhat.com/show_bug.cgi?id=1431038 • CWE-190: Integer Overflow or Wraparound •