CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5212 – chromium-browser: local file disclosure in devtools
https://notcve.org/view.php?id=CVE-2016-5212
Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android insufficiently sanitized DevTools URLs, which allowed a remote attacker to read local files via a crafted HTML page. Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android desinfecta insuficientemente URLs DevTools, lo que permitió a un atacante remoto leer archivos locales a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/653134 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5212 https://bugzilla.redhat.com/show_bug.cgi?id=1400861 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5214 – chromium-browser: file download protection bypass
https://notcve.org/view.php?id=CVE-2016-5214
Google Chrome prior to 55.0.2883.75 for Windows mishandled downloaded files, which allowed a remote attacker to prevent the downloaded file from receiving the Mark of the Web via a crafted HTML page. Google Chrome anterior a 55.0.2883.75 para Windows no maneja adecuadamente archivos descargados, lo que permitió a un atacante remoto impedir que el archivo descargado recibiera la Mark de la Web a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/601538 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-5214 https://bugzilla.redhat.com/show_bug.cgi?id=1400864 • CWE-19: Data Processing Errors •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9652 – chromium-browser: various fixes from internal audits
https://notcve.org/view.php?id=CVE-2016-9652
Multiple unspecified vulnerabilities in Google Chrome before 55.0.2883.75. múltiples vulnerabilidades no especificadas en Google Chrome anterior a la versión 55,0,2883,75 • http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00050.html http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00042.html http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.debian.org/security/2016/dsa-3731 http://www.securityfocus.com/bid/94633 http://www.ubuntu.com/usn/USN-3153-1 https://bugs.chromium.org/p/chromium/issues/detail?id=669928 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://lists. •
CVSS: 8.8EPSS: 36%CPEs: 4EXPL: 1CVE-2016-9651 – Google Chrome - V8 Private Property Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2016-9651
A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. La falta de una comprobación para detectar si la propiedad de un objeto JS es privado en V8 de Google Chome, en versiones anteriores a la 55.0.2883.75, permitió que un atacante remoto ejecutara código arbitrario en un sandbox mediante una página HTML manipulada. • https://www.exploit-db.com/exploits/42175 http://rhn.redhat.com/errata/RHSA-2016-2919.html http://www.securityfocus.com/bid/94633 https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html https://crbug.com/664411 https://security.gentoo.org/glsa/201612-11 https://access.redhat.com/security/cve/CVE-2016-9651 https://bugzilla.redhat.com/show_bug.cgi?id=1400850 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.1EPSS: 0%CPEs: 6EXPL: 0CVE-2016-5202 – chromium-browser: various fixes from internal audits
https://notcve.org/view.php?id=CVE-2016-5202
browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux neglects to copy a device ID before an erase() call, which causes the erase operation to access data that that erase operation will destroy. El archivo browser/extensions/api/dial/dial_registry.cc en Google Chrome versiones anteriores a 54.0.2840.98 en macOS, versiones anteriores a 54.0.2840.99 en Windows y versiones anteriores a 54.0.2840.100 en Linux, no copia un ID de dispositivo antes de una llamada de erase(), lo que causa la operación de borrado para acceder a los datos que esa operación de borrado destruirá. • http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00029.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-5202 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2016-5202 https://security-tracker.debian.org/tracker/CVE-2016-5202 https://access.redhat.com/security/cve/CVE-2016-5202 https://bugzilla.redhat.com/show_bug.cgi?id=1393734 • CWE-732: Incorrect Permission Assignment for Critical Resource •