CVSS: 4.3EPSS: 0%CPEs: 80EXPL: 0CVE-2014-1747
https://notcve.org/view.php?id=CVE-2014-1747
Cross-site scripting (XSS) vulnerability in the DocumentLoader::maybeCreateArchive function in core/loader/DocumentLoader.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to inject arbitrary web script or HTML via crafted MHTML content, aka "Universal XSS (UXSS)." Vulnerabilidad de XSS en la función DocumentLoader::maybeCreateArchive en core/loader/DocumentLoader.cpp en Blink, utilizado en Google Chrome anterior a 35.0.1916.114, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de contenido MHTML manipulado, también conocido como 'XSS universal (UXSS).' • http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html http://lists.opensuse.org/opensuse-updates/2014-06/msg00023.html http://secunia.com/advisories/58920 http://secunia.com/advisories/59155 http://security.gentoo.org/glsa/glsa-201408-16.xml http://www.debian.org/security/2014/dsa-2939 http://www.securitytracker.com/id/1030270 https://code.google.com/p/chromium/issues/detail?id=330663 https://src.chromium.org/viewvc/blink?revision=169499&view=revision • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 80EXPL: 0CVE-2014-1745 – webkitgtk: Processing a file may lead to a denial of service or potentially disclose memory contents
https://notcve.org/view.php?id=CVE-2014-1745
Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger removal of an SVGFontFaceElement object, related to core/svg/SVGFontFaceElement.cpp. Vulnerabilidad de uso después de liberación en la implementación SVG en Blink, utilizado en Google Chrome anterior a 35.0.1916.114, permite a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto no especificado a través de vectores que provocan la eliminación de un objeto SVGFontFaceElement, relacionado con core/svg/SVGFontFaceElement.cpp. A use-after-free vulnerability was found in the SVG implementation within WebKitGTK. This flaw allows remote attackers to exploit the removal of an SVGFontFaceElement object, which occurs through specific vectors that trigger the deletion of the object during rendering. • http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html http://lists.opensuse.org/opensuse-updates/2014-06/msg00023.html http://secunia.com/advisories/58920 http://secunia.com/advisories/59155 http://security.gentoo.org/glsa/glsa-201408-16.xml http://www.debian.org/security/2014/dsa-2939 http://www.openwall.com/lists/oss-security/2024/02/05/8 http://www.securitytracker.com/id/1030270 https://code.google.com/p/chromium/issues/detail?id=346192 https: • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 1%CPEs: 93EXPL: 0CVE-2014-1742
https://notcve.org/view.php?id=CVE-2014-1742
Use-after-free vulnerability in the FrameSelection::updateAppearance function in core/editing/FrameSelection.cpp in Blink, as used in Google Chrome before 34.0.1847.137, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper RenderObject handling. Vulnerabilidad de uso después de liberación en la función FrameSelection::updateAppearance en core/editing/FrameSelection.cpp en Blink, utilizado en Google Chrome anterior a 34.0.1847.137, permite a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto no especificado mediante el aprovechamiento del manjo RenderObject indebido. • http://googlechromereleases.blogspot.com/2014/05/stable-channel-update.html http://lists.opensuse.org/opensuse-updates/2014-06/msg00023.html http://secunia.com/advisories/59155 http://secunia.com/advisories/60372 http://security.gentoo.org/glsa/glsa-201408-16.xml http://www.debian.org/security/2014/dsa-2930 http://www.securityfocus.com/bid/67375 http://www.securitytracker.com/id/1030240 https://code.google.com/p/chromium/issues/detail?id=356690 https://src.chromium.org/viewvc • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 1%CPEs: 93EXPL: 0CVE-2014-1740
https://notcve.org/view.php?id=CVE-2014-1740
Multiple use-after-free vulnerabilities in net/websockets/websocket_job.cc in the WebSockets implementation in Google Chrome before 34.0.1847.137 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to WebSocketJob deletion. Múltiples vulnerabilidades de uso después de liberación en net/websockets/websocket_job.cc en la implementación WebSockets en Google Chrome anterior a 34.0.1847.137 permiten a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto no especificado a través de vectores relacionados con la eliminación de WebSocketJob. • http://googlechromereleases.blogspot.com/2014/05/stable-channel-update.html http://lists.opensuse.org/opensuse-updates/2014-06/msg00023.html http://secunia.com/advisories/59155 http://secunia.com/advisories/60372 http://security.gentoo.org/glsa/glsa-201408-16.xml http://www.debian.org/security/2014/dsa-2930 http://www.securityfocus.com/bid/67374 http://www.securitytracker.com/id/1030240 https://code.google.com/p/chromium/issues/detail?id=358038 https://src.chromium.org/viewvc • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 1%CPEs: 93EXPL: 0CVE-2014-1741
https://notcve.org/view.php?id=CVE-2014-1741
Multiple integer overflows in the replace-data functionality in the CharacterData interface implementation in core/dom/CharacterData.cpp in Blink, as used in Google Chrome before 34.0.1847.137, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to ranges. Múltiples desbordamientos de enteros en la funcionalidad replace-data en la implemenatción de interfaz CharacterData en core/dom/CharacterData.cpp en Blink, utilizado en Google Chrome anterior a 34.0.1847.137, permiten a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto no especificado a través de vectores relacionados con rangos. • http://googlechromereleases.blogspot.com/2014/05/stable-channel-update.html http://lists.opensuse.org/opensuse-updates/2014-06/msg00023.html http://secunia.com/advisories/59155 http://secunia.com/advisories/60372 http://security.gentoo.org/glsa/glsa-201408-16.xml http://www.debian.org/security/2014/dsa-2930 http://www.securityfocus.com/bid/67376 http://www.securitytracker.com/id/1030240 https://code.google.com/p/chromium/issues/detail?id=349898 https://src.chromium.org/viewvc • CWE-189: Numeric Errors •