CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2015-1213 – chromium-browser: Out-of-bounds write in skia filters
https://notcve.org/view.php?id=CVE-2015-1213
The SkBitmap::ReadRawPixels function in core/SkBitmap.cpp in the filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation. La función SkBitmap::ReadRawPixels en core/SkBitmap.cpp en la implementación de filtrado en Skia, utilizado en Google Chrome anterior a 41.0.2272.76, permite a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto no especificado a través de vectores que provocan una operación de escritura fuera de rango. • http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html http://rhn.redhat.com/errata/RHSA-2015-0627.html http://www.securityfocus.com/bid/72901 http://www.ubuntu.com/usn/USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=448423 https://security.gentoo.org/glsa/201503-12 https://skia.googlesource.com/skia/+/6af314724f51ad79a640844536c667bb83de5690 https://access.redhat.com/security/cve/CVE-2015-1213 https://bugzilla.redhat.com/show_bug.cgi?id=1198519 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2015-1223 – chromium-browser: Use-after-free in dom
https://notcve.org/view.php?id=CVE-2015-1223
Multiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger extraneous change events, as demonstrated by events for invalid input or input to read-only fields, related to the initializeTypeInParsing and updateType functions. Múltiples vulnerabilidades de uso después de liberación en core/html/HTMLInputElement.cpp en la implementación DOM en Blink, utilizado en Google Chrome anterior a 41.0.2272.76, permiten a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto no especificado a través de vectores que provocan eventos de cambio extraños, tal y como fue demostrado por eventos para entradas inválidas o entradas a campos de solo lectura, relacionado con las funciones initializeTypeInParsing y updateType. • http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html http://rhn.redhat.com/errata/RHSA-2015-0627.html http://www.securityfocus.com/bid/72901 http://www.ubuntu.com/usn/USN-2521-1 https://chromium.googlesource.com/chromium/blink.git/+/de1fee41e2c1bbfea7a564ad81e0b511a462fe0b https://code.google.com/p/chromium/issues/detail?id=454231 https://security.gentoo.org/glsa/201503-12 https://access.redhat.com/security/cve/CVE-2015-1223 https://bugzilla.redhat.com/show_bug • CWE-416: Use After Free •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2015-1218 – chromium-browser: Use-after-free in dom
https://notcve.org/view.php?id=CVE-2015-1218
Multiple use-after-free vulnerabilities in the DOM implementation in Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger movement of a SCRIPT element to different documents, related to (1) the HTMLScriptElement::didMoveToNewDocument function in core/html/HTMLScriptElement.cpp and (2) the SVGScriptElement::didMoveToNewDocument function in core/svg/SVGScriptElement.cpp. Múltiples vulnerabilidades de uso después de liberación en la implementación DOM en Blink, utilizado en Google Chrome anterior a 41.0.2272.76, permiten a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto no especificado a través de vectores que provocan el traslado de un elemento SCRIPT a documentos diferentes, relacionado con (1) la función HTMLScriptElement::didMoveToNewDocument en core/html/HTMLScriptElement.cpp y (2) la función SVGScriptElement::didMoveToNewDocument en core/svg/SVGScriptElement.cpp. • http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html http://rhn.redhat.com/errata/RHSA-2015-0627.html http://www.securityfocus.com/bid/72901 http://www.ubuntu.com/usn/USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=456059 https://security.gentoo.org/glsa/201503-12 https://src.chromium.org/viewvc/blink?revision=189886&view=revision https://access.redhat.com/security/cve/CVE-2015-1218 https://bugzilla.redhat.com/show_bug.cgi?id=1198525 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 3%CPEs: 7EXPL: 0CVE-2015-1230 – Google Chrome V8EventListenerList::findOrCreateWrapper Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-1230
The getHiddenProperty function in bindings/core/v8/V8EventListenerList.h in Blink, as used in Google Chrome before 41.0.2272.76, has a name conflict with the AudioContext class, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via JavaScript code that adds an AudioContext event listener and triggers "type confusion." La función getHiddenProperty en bindings/core/v8/V8EventListenerList.h en Blink, utilizado en Google Chrome anterior a 41.0.2272.76, tiene un conflicto de nombres con la clase AudioContext, lo que permite a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto no especificado a través de código JavaScript que añade un oyente de eventos AudioContext y provoca una 'confusión de tipos.' This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Google Chrome. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within findOrCreateWrapper. By manipulating a document's elements, an attacker can force a type confusion error while adding an event listener. • http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html http://rhn.redhat.com/errata/RHSA-2015-0627.html http://www.securityfocus.com/bid/72901 http://www.ubuntu.com/usn/USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=449610 https://security.gentoo.org/glsa/201503-12 https://src.chromium.org/viewvc/blink?revision=189006&view=revision https://access.redhat.com/security/cve/CVE-2015-1230 https://bugzilla.redhat.com/show_bug.cgi?id=1198537 • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2015-1215 – chromium-browser: Out-of-bounds write in skia filters
https://notcve.org/view.php?id=CVE-2015-1215
The filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation. La implementación de filtrado en Skia, utilizado en Google Chrome anterior a 41.0.2272.76, permite a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto no especificado a través de vectores que provocan una operación de escritura fuera de rango. • http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html http://rhn.redhat.com/errata/RHSA-2015-0627.html http://www.securityfocus.com/bid/72901 http://www.ubuntu.com/usn/USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=445809 https://security.gentoo.org/glsa/201503-12 https://access.redhat.com/security/cve/CVE-2015-1215 https://bugzilla.redhat.com/show_bug.cgi?id=1198521 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •