CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 1CVE-2020-6386 – chromium-browser: Use after free in speech
https://notcve.org/view.php?id=CVE-2020-6386
Use after free in speech in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un uso de la memoria previamente liberada en speech en Google Chrome versiones anteriores a 80.0.3987.116, permitió a un atacante remoto explotar potencialmente una corrupción de la pila por medio de una página HTML diseñada. • https://access.redhat.com/errata/RHSA-2020:0738 https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_18.html https://crbug.com/1043603 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3B5RWJQD5LA45MYLLR55KZJOJ5NVZGP https://www.debian.org/security/2020/dsa-4638 https://access.redhat.com/security/cve/CVE-2020-6386 https:/ • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 1CVE-2020-6384 – chromium-browser: Use after free in WebAudio
https://notcve.org/view.php?id=CVE-2020-6384
Use after free in WebAudio in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un uso de la memoria previamente liberada en WebAudio en Google Chrome versiones anteriores a 80.0.3987.116, permitió a un atacante remoto explotar potencialmente una corrupción de la pila por medio de una página HTML diseñada. • https://access.redhat.com/errata/RHSA-2020:0738 https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_18.html https://crbug.com/1048473 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3B5RWJQD5LA45MYLLR55KZJOJ5NVZGP https://www.debian.org/security/2020/dsa-4638 https://access.redhat.com/security/cve/CVE-2020-6384 https:/ • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 1CVE-2020-6383 – chromium-browser: Type confusion in V8
https://notcve.org/view.php?id=CVE-2020-6383
Type confusion in V8 in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Una confusión de tipos en V8 en Google Chrome versiones anteriores a 80.0.3987.116, permitió a un atacante remoto explotar potencialmente una corrupción de la pila por medio de una página HTML diseñada. • https://access.redhat.com/errata/RHSA-2020:0738 https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_18.html https://crbug.com/1051017 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3B5RWJQD5LA45MYLLR55KZJOJ5NVZGP https://www.debian.org/security/2020/dsa-4638 https://access.redhat.com/security/cve/CVE-2020-6383 https:/ • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2020-3864 – webkitgtk: Non-unique security origin for DOM object contexts
https://notcve.org/view.php?id=CVE-2020-3864
A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17, iTunes 12.10.4 for Windows, iCloud for Windows 10.9.2, tvOS 13.3.1, Safari 13.0.5, iOS 13.3.1 and iPadOS 13.3.1. A DOM object context may not have had a unique security origin. Se abordó un problema lógico con una comprobación mejorada. Este problema se corrigió en iCloud para Windows versión 7.17, iTunes versión 12.10.4 para Windows, iCloud para Windows versión 10.9.2, tvOS versión 13.3.1, Safari versión 13.0.5, iOS versión 13.3.1 y iPadOS versión 13.3.1. • https://support.apple.com/en-us/HT210918 https://support.apple.com/en-us/HT210920 https://support.apple.com/en-us/HT210922 https://support.apple.com/en-us/HT210923 https://support.apple.com/en-us/HT210947 https://support.apple.com/en-us/HT210948 https://access.redhat.com/security/cve/CVE-2020-3864 https://bugzilla.redhat.com/show_bug.cgi?id=1876518 • CWE-346: Origin Validation Error •
CVSS: 9.3EPSS: 2%CPEs: 17EXPL: 0CVE-2020-3757 – flash-plugin: Arbitrary Code Execution vulnerability (APSB20-06)
https://notcve.org/view.php?id=CVE-2020-3757
Adobe Flash Player versions 32.0.0.321 and earlier, 32.0.0.314 and earlier, 32.0.0.321 and earlier, and 32.0.0.255 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution. Adobe Flash Player versiones 32.0.0.321 y anteriores, 32.0.0.314 y anteriores, 32.0.0.321 y anteriores, y 32.0.0.255 y anteriores, presenta una vulnerabilidad de confusión de tipos. Una explotación con éxito podría conllevar a una ejecución de código arbitrario. • https://access.redhat.com/errata/RHSA-2020:0513 https://helpx.adobe.com/security/products/flash-player/apsb20-06.html https://security.gentoo.org/glsa/202003-61 https://access.redhat.com/security/cve/CVE-2020-3757 https://bugzilla.redhat.com/show_bug.cgi?id=1801792 • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •