CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5220 – chromium-browser: local file access in pdfium
https://notcve.org/view.php?id=CVE-2016-5220
PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to read local files via a crafted PDF file. PDFium en Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android maneja incorrectamente la navegación en PDFs, lo que permitió a un atacante remoto leer archivos locales a través de un archivo PDF manipulado. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/654279 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5220 https://bugzilla.redhat.com/show_bug.cgi?id=1400871 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5206 – chromium-browser: same-origin bypass in pdfium
https://notcve.org/view.php?id=CVE-2016-5206
The PDF plugin in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly followed redirects, which allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page. El plugin PDF en Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android redirecciona seguimiento incorrectamente, lo que permitió a un atacante remoto eludir la Same Origin Policy a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/653749 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5206 https://bugzilla.redhat.com/show_bug.cgi?id=1400853 • CWE-284: Improper Access Control •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5219 – chromium-browser: use after free in v8
https://notcve.org/view.php?id=CVE-2016-5219
A heap use after free in V8 in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un uso después de liberación de memoria en V8 en Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android permitió a un atacante remoto explotar potencialmente corrupción de memoria a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/657568 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5219 https://bugzilla.redhat.com/show_bug.cgi?id=1400869 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5205 – chromium-browser: universal xss in blink
https://notcve.org/view.php?id=CVE-2016-5205
Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac, incorrectly handles deferred page loads, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Blink en Google Chrome anterior a 55.0.2883.75 para Linux, Windows y Mac, maneja incorrectamente cargas de página diferida, lo que permite a un atacante remoto inyectar secuencias de comandos o HTML arbitrarios (UXSS) a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/646610 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5205 https://bugzilla.redhat.com/show_bug.cgi?id=1400854 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5224 – chromium-browser: same-origin bypass in svg
https://notcve.org/view.php?id=CVE-2016-5224
A timing attack on denormalized floating point arithmetic in SVG filters in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page. Un ataque de tiempo en aritmética de punto flotante desnormalizada en filtros SVG en Blink en Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android permitió a un atacante eludir la Same Origin Policy a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/615851 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5224 https://bugzilla.redhat.com/show_bug.cgi?id=1400878 • CWE-189: Numeric Errors •