CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 0CVE-2016-1694 – chromium-browser: hpkp pins removed on cache clearance
https://notcve.org/view.php?id=CVE-2016-1694
01 Jun 2016 — browser/browsing_data/browsing_data_remover.cc in Google Chrome before 51.0.2704.63 deletes HPKP pins during cache clearing, which makes it easier for remote attackers to spoof web sites via a valid certificate from an arbitrary recognized Certification Authority. browser/browsing_data/browsing_data_remover.cc en Google Chrome en versiones anteriores a 51.0.2704.63 borra los pins HPKP durante la limpieza de la caché, lo que hace más fácil para atacantes remotos suplantar páginas web a través de un certifica... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 0%CPEs: 11EXPL: 0CVE-2016-1673 – chromium-browser: cross-origin bypass in blink
https://notcve.org/view.php?id=CVE-2016-1673
01 Jun 2016 — Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy via unspecified vectors. Blink, como es usado en Google Chrome en versiones anteriores a 51.0.2704.63 permite a atacantes remotos eludir la Same Origin Policy a través de vectores no especificados. An unspecified security issue was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. An i... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2016-1674 – chromium-browser: cross-origin bypass in extensions
https://notcve.org/view.php?id=CVE-2016-1674
01 Jun 2016 — The extensions subsystem in Google Chrome before 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified vectors. El subsistema de extensiones en Google Chrome en versiones anteriores a 51.0.2704.63 permite a atacantes remotos eludir la Same Origin Policy a través de vectores no especificados. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 51.0.2704.63. Security Fix: Multiple flaws were found in the processing of malformed we... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html •
CVSS: 6.5EPSS: 1%CPEs: 8EXPL: 0CVE-2016-1686 – chromium-browser: out-of-bounds read in pdfium
https://notcve.org/view.php?id=CVE-2016-1686
01 Jun 2016 — The CPDF_DIBSource::CreateDecoder function in core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp in PDFium, as used in Google Chrome before 51.0.2704.63, mishandles decoder-initialization failure, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document. La función CPDF_DIBSource::CreateDecoder en core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp en PDFium, como es usada en Google Chrome en versiones anteriores a 51.0.2704.63, no maneja correctamente el fal... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2016-1681 – chromium-browser: heap overflow in pdfium
https://notcve.org/view.php?id=CVE-2016-1681
01 Jun 2016 — Heap-based buffer overflow in the opj_j2k_read_SPCod_SPCoc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 51.0.2704.63, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document. Desbordamiento de buffer basado en memoria dinámica en la función opj_j2k_read_SPCod_SPCoc en OpenJPEG, como es usado en PDFium en Google Chrome en versiones anteriores a 51.0.2704.63, permite a atacantes remotos provocar una denegación de ser... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 1%CPEs: 8EXPL: 0CVE-2016-1690 – chromium-browser: heap use-after-free in autofill
https://notcve.org/view.php?id=CVE-2016-1690
01 Jun 2016 — The Autofill implementation in Google Chrome before 51.0.2704.63 mishandles the interaction between field updates and JavaScript code that triggers a frame deletion, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site, a different vulnerability than CVE-2016-1701. La implementación de Autofill en Google Chrome en versiones anteriores a 51.0.2704.63 no maneja correctamente la interacción entre campos actualizados y códig... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html •
CVSS: 7.5EPSS: 1%CPEs: 11EXPL: 0CVE-2016-1691 – chromium-browser: heap buffer-overflow in skia
https://notcve.org/view.php?id=CVE-2016-1691
01 Jun 2016 — Skia, as used in Google Chrome before 51.0.2704.63, mishandles coincidence runs, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted curves, related to SkOpCoincidence.cpp and SkPathOpsCommon.cpp. Skia, como es usado en Google Chrome en versiones anteriores a 51.0.2704.63, no maneja correctamente la ejecución de coincidencia, lo que permite a atacantes remotos provocar una denegación del servicio (desbordamiento de buf... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 0CVE-2016-1693 – chromium-browser: http download of software removal tool
https://notcve.org/view.php?id=CVE-2016-1693
01 Jun 2016 — browser/safe_browsing/srt_field_trial_win.cc in Google Chrome before 51.0.2704.63 does not use the HTTPS service on dl.google.com to obtain the Software Removal Tool, which allows remote attackers to spoof the chrome_cleanup_tool.exe (aka CCT) file via a man-in-the-middle attack on an HTTP session. browser/safe_browsing/srt_field_trial_win.cc en Google Chrome en versiones anteriores a 51.0.2704.63 no usa el servicio HTTPS en dl.google.com para obtener el Software Removal Tool, lo que permite a atacantes sup... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-284: Improper Access Control •
CVSS: 6.5EPSS: 1%CPEs: 8EXPL: 0CVE-2016-1685 – chromium-browser: out-of-bounds read in pdfium
https://notcve.org/view.php?id=CVE-2016-1685
01 Jun 2016 — core/fxge/ge/fx_ge_text.cpp in PDFium, as used in Google Chrome before 51.0.2704.63, miscalculates certain index values, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document. core/fxge/ge/fx_ge_text.cpp en PDFium, como es usado en Google Chrome en versiones anteriores a 51.0.2704.63, no calcula correctamente ciertos valores del índice, lo que permite a atacantes remotos provocar una denegación del servicio (lectura fuera de límites) a través de un docume... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 1%CPEs: 11EXPL: 0CVE-2016-1679 – chromium-browser: heap use-after-free in v8 bindings
https://notcve.org/view.php?id=CVE-2016-1679
01 Jun 2016 — The ToV8Value function in content/child/v8_value_converter_impl.cc in the V8 bindings in Google Chrome before 51.0.2704.63 does not properly restrict use of getters and setters, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code. La función ToV8Value en content/child/v8_value_converter_impl.cc en los vínculos V8 en Google Chrome en versiones anteriores a 51.0.2704.63 no restringe adecuadamente el uso de captadores... • http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html •