CVSS: 8.8EPSS: 23%CPEs: 4EXPL: 1CVE-2016-9651 – Google Chrome - V8 Private Property Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2016-9651
A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. La falta de una comprobación para detectar si la propiedad de un objeto JS es privado en V8 de Google Chome, en versiones anteriores a la 55.0.2883.75, permitió que un atacante remoto ejecutara código arbitrario en un sandbox mediante una página HTML manipulada. • https://www.exploit-db.com/exploits/42175 http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/664411 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-9651 https://bugzilla.redhat.com/show_bug.cgi?id=1400850 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5205 – chromium-browser: universal xss in blink
https://notcve.org/view.php?id=CVE-2016-5205
Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac, incorrectly handles deferred page loads, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Blink en Google Chrome anterior a 55.0.2883.75 para Linux, Windows y Mac, maneja incorrectamente cargas de página diferida, lo que permite a un atacante remoto inyectar secuencias de comandos o HTML arbitrarios (UXSS) a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/646610 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5205 https://bugzilla.redhat.com/show_bug.cgi?id=1400854 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5225 – chromium-browser: csp bypass in blink
https://notcve.org/view.php?id=CVE-2016-5225
Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled form actions, which allowed a remote attacker to bypass Content Security Policy via a crafted HTML page. Blink en Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android manejó incorrectamente acciones de formularios, lo que permitió a un atacante remoto eludir la Content Security Policy a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/630332 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5225 https://bugzilla.redhat.com/show_bug.cgi?id=1400877 • CWE-19: Data Processing Errors •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5223 – chromium-browser: integer overflow in pdfium
https://notcve.org/view.php?id=CVE-2016-5223
Integer overflow in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption or DoS via a crafted PDF file. Vulnerabilidad de desbordamiento de entero en PDFium en Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android permitió a un atacante remoto explotar potencialmente la corrupción de memoria o DoS a través de un archivo PDF manipulado. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/652038 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5223 https://bugzilla.redhat.com/show_bug.cgi?id=1400875 • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5203 – chromium-browser: use after free in pdfium
https://notcve.org/view.php?id=CVE-2016-5203
A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Un uso después de liberación de memoria en PDFium en Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android permitió a un atacante remoto explotar potencialmente una corrupción de memoria a través de un archivo PDF manipulado. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/644219 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5203 https://bugzilla.redhat.com/show_bug.cgi?id=1400857 • CWE-416: Use After Free •