CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1296 – chromium-browser: Character spoofing in omnibox
https://notcve.org/view.php?id=CVE-2015-1296
The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages. Vulnerabilidad en la implementación UnescapeURLWithAdjustmentsImpl en net/base/escape.cc en Google Chrome en versiones anteriores a 45.0.2454.85, no impide que se visualicen caracteres Unicode LOCK en el omnibox, lo que facilita a atacantes remotos suplantar el icono de bloqueo SSL poniendo uno de estos caracteres al final de una URL, según lo demostrado por el omnibox en localizaciones para los lenguajes de derecha a izquierda. • http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html http://rhn.redhat.com/errata/RHSA-2015-1712.html http://www.debian.org/security/2015/dsa-3351 http://www.securitytracker.com/id/1033472 https://code.google.com/p/chromium/issues/detail?id=421332 https://codereview.chromium.org/1180393003 https://codereview.chromium.org/1189553002 https: • CWE-254: 7PK - Security Features •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2015-1297 – chromium-browser: Permission scoping error in WebRequest
https://notcve.org/view.php?id=CVE-2015-1297
The WebRequest API implementation in extensions/browser/api/web_request/web_request_api.cc in Google Chrome before 45.0.2454.85 does not properly consider a request's source before accepting the request, which allows remote attackers to bypass intended access restrictions via a crafted (1) app or (2) extension. Vulnerabilidad en la implementación WebRequest API en extensions/browser/api/web_request/web_request_api.cc en Google Chrome en versiones anteriores a 45.0.2454.85, no considera correctamente una fuente de petición antes de aceptar la petición, lo que permite a atacantes remotos eludir las restricciones de acceso previstas a través de una (1) app o (2) extensión manipulada. • http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html http://rhn.redhat.com/errata/RHSA-2015-1712.html http://www.debian.org/security/2015/dsa-3351 http://www.securitytracker.com/id/1033472 https://code.google.com/p/chromium/issues/detail?id=510802 https://codereview.chromium.org/1267183003 https://security.gentoo.org/glsa/201603-09 • CWE-254: 7PK - Security Features •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1298 – chromium-browser: URL validation error in extensions
https://notcve.org/view.php?id=CVE-2015-1298
The RuntimeEventRouter::OnExtensionUninstalled function in extensions/browser/api/runtime/runtime_api.cc in Google Chrome before 45.0.2454.85 does not ensure that the setUninstallURL preference corresponds to the URL of a web site, which allows user-assisted remote attackers to trigger access to an arbitrary URL via a crafted extension that is uninstalled. Vulnerabilidad en la función RuntimeEventRouter::OnExtensionUninstalled en extensions/browser/api/runtime/runtime_api.cc en Google Chrome en versiones anteriores a 45.0.2454.85, no asegura que la preferencia setUninstallURL corresponda con la URL de una página web, lo que permite atacantes remotos asistidos por usuario desencadenar acceso a una URL arbitraria a través de una extensión manipulada que es desinstalada. • http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html http://rhn.redhat.com/errata/RHSA-2015-1712.html http://www.debian.org/security/2015/dsa-3351 http://www.securitytracker.com/id/1033472 https://code.google.com/p/chromium/issues/detail?id=518827 https://codereview.chromium.org/1282263002 https://security.gentoo.org/glsa/201603-09 • CWE-254: 7PK - Security Features •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2015-1299 – chromium-browser: Use-after-free in Blink
https://notcve.org/view.php?id=CVE-2015-1299
Use-after-free vulnerability in the shared-timer implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging erroneous timer firing, related to ThreadTimers.cpp and Timer.cpp. Vulnerabilidad de uso después de liberación en la memoria en la implementación shared-timer en Blink, como se utiliza en Google Chrome en versiones anteriores a 45.0.2454.85, permite a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto no especificado aprovechando la activación errónea del temporizador, relacionada con ThreadTimers.cpp y Timer.cpp. • http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html http://rhn.redhat.com/errata/RHSA-2015-1712.html http://www.debian.org/security/2015/dsa-3351 http://www.securitytracker.com/id/1033472 https://code.google.com/p/chromium/issues/detail?id=416362 https://codereview.chromium.org/1153763005 https://codereview.chromium.org/956333002 https: • CWE-416: Use After Free •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1300 – chromium-browser: Information leak in Blink
https://notcve.org/view.php?id=CVE-2015-1300
The FrameFetchContext::updateTimingInfoForIFrameNavigation function in core/loader/FrameFetchContext.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to obtain sensitive information via crafted JavaScript code that leverages a history.back call. Vulnerabilidad en la función FrameFetchContext::updateTimingInfoForIFrameNavigation en core/loader/FrameFetchContext.cpp en Blink, como se utiliza en Google Chrome en versiones anteriores a 45.0.2454.85, no restringe correctamente la disponibilidad de tiempos de la API IFRAME Resource Timing, lo que permite a atacantes remotos obtener información sensible a través de código JavaScript manipulado que aprovecha una llamada history.back. • http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html http://rhn.redhat.com/errata/RHSA-2015-1712.html http://www.debian.org/security/2015/dsa-3351 http://www.securitytracker.com/id/1033472 https://code.google.com/p/chromium/issues/detail?id=511616 https://github.com/w3c/resource-timing/issues/29 https://security.gentoo.org/glsa&#x • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-254: 7PK - Security Features •