CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5212 – chromium-browser: local file disclosure in devtools
https://notcve.org/view.php?id=CVE-2016-5212
Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android insufficiently sanitized DevTools URLs, which allowed a remote attacker to read local files via a crafted HTML page. Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android desinfecta insuficientemente URLs DevTools, lo que permitió a un atacante remoto leer archivos locales a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/653134 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5212 https://bugzilla.redhat.com/show_bug.cgi?id=1400861 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5214 – chromium-browser: file download protection bypass
https://notcve.org/view.php?id=CVE-2016-5214
Google Chrome prior to 55.0.2883.75 for Windows mishandled downloaded files, which allowed a remote attacker to prevent the downloaded file from receiving the Mark of the Web via a crafted HTML page. Google Chrome anterior a 55.0.2883.75 para Windows no maneja adecuadamente archivos descargados, lo que permitió a un atacante remoto impedir que el archivo descargado recibiera la Mark de la Web a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/601538 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5214 https://bugzilla.redhat.com/show_bug.cgi?id=1400864 • CWE-19: Data Processing Errors •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5217 – chromium-browser: use of unvalidated data in pdfium
https://notcve.org/view.php?id=CVE-2016-5217
The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly permitted access to privileged plugins, which allowed a remote attacker to bypass site isolation via a crafted HTML page. La API de extensiones en Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux permite acceso de manera incorrecta a plugins privilegiados, lo que permitió a un atacante remoto eludir el aislamiento del sitio a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/654280 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5217 https://bugzilla.redhat.com/show_bug.cgi?id=1400867 • CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5210 – chromium-browser: out of bounds write in pdfium
https://notcve.org/view.php?id=CVE-2016-5210
Heap buffer overflow during TIFF image parsing in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Desbordamiento de búfer basado en memoria dinámica durante el análisis de imagen TIFF en PDFium en Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android permitió a un atacante remoto explotar potencialmente corrupción de memoria a través de un archivo PDF manipulado. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/654183 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5210 https://bugzilla.redhat.com/show_bug.cgi?id=1400859 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5222 – chromium-browser: address spoofing in omnibox
https://notcve.org/view.php?id=CVE-2016-5222
Incorrect handling of invalid URLs in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. Manejo incorrecto de URLs no válidas en Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android permitió a un atacante remoto suplantar los contenidos de la Omnibox (barra de URL) a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/657720 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5222 https://bugzilla.redhat.com/show_bug.cgi?id=1400872 • CWE-20: Improper Input Validation •