CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 0CVE-2018-18359 – chromium-browser: Out of bounds read in V8
https://notcve.org/view.php?id=CVE-2018-18359
Incorrect handling of Reflect.construct in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. La gestión incorrecta de Reflect.construct en V8 en Google Chrome en versiones anteriores a la 71.0.3578.80 permitía que un atacante remoto pudiese realizar una lectura de memoria fuera de límites mediante una página HTML manipulada. • http://www.securityfocus.com/bid/106084 https://access.redhat.com/errata/RHSA-2018:3803 https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html https://crbug.com/907714 https://security.gentoo.org/glsa/201908-18 https://www.debian.org/security/2018/dsa-4352 https://access.redhat.com/security/cve/CVE-2018-18359 https://bugzilla.redhat.com/show_bug.cgi?id=1656573 • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-18348 – chromium-browser: Inappropriate implementation in Omnibox
https://notcve.org/view.php?id=CVE-2018-18348
Incorrect handling of bidirectional domain names with RTL characters in Omnibox in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. El manejo incorrecto de nombres de dominio bidireccionales con caracteres RTL en Omnibox en Google Chrome, en versiones anteriores a la 71.0.3578.80, permitía que un atacante remoto suplante el contenido del Omnibox (barra de URL) mediante un nombre de dominio manipulado. • http://www.securityfocus.com/bid/106084 https://access.redhat.com/errata/RHSA-2018:3803 https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html https://crbug.com/881659 https://security.gentoo.org/glsa/201908-18 https://www.debian.org/security/2018/dsa-4352 https://access.redhat.com/security/cve/CVE-2018-18348 https://bugzilla.redhat.com/show_bug.cgi?id=1656562 •
CVSS: 8.8EPSS: 2%CPEs: 5EXPL: 0CVE-2018-18341 – chromium-browser: Heap buffer overflow in Blink
https://notcve.org/view.php?id=CVE-2018-18341
An integer overflow leading to a heap buffer overflow in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un desbordamiento de enteros basado en memoria dinámica (heap) en Blink en Google Chrome, en versiones anteriores a la 71.0.3578.80, permite a un atacante remoto explotar la corrupción de la memoria dinámica (heap) mediante una página HTML manipulada. • http://www.securityfocus.com/bid/106084 https://access.redhat.com/errata/RHSA-2018:3803 https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html https://crbug.com/901030 https://security.gentoo.org/glsa/201908-18 https://www.debian.org/security/2018/dsa-4352 https://access.redhat.com/security/cve/CVE-2018-18341 https://bugzilla.redhat.com/show_bug.cgi?id=1656555 • CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 1%CPEs: 6EXPL: 0CVE-2018-18335 – chromium-browser: Heap buffer overflow in Skia
https://notcve.org/view.php?id=CVE-2018-18335
Heap buffer overflow in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un desbordamiento de búfer basado en memoria dinámica (heap) en Skia en Google Chrome, en versiones anteriores a la 71.0.3578.80, permite que un atacante remoto explote la corrupción de la memoria dinámica (heap) mediante una página HTML manipulada. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00043.html http://www.securityfocus.com/bid/106084 https://access.redhat.com/errata/RHSA-2018:3803 https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html https://crbug.com/895362 https://security.gentoo.org/glsa/201904-07 https://security.gentoo.org/glsa/201908-18 https://www.debian.org/security/2018/dsa-4352 https://access.redhat.com/security/cve/CVE-2018-18335 https://bugzilla.redhat& • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 2%CPEs: 17EXPL: 0CVE-2018-18356 – mozilla: Use after free in Skia
https://notcve.org/view.php?id=CVE-2018-18356
An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un desbordamiento de enteros en el manejo de rutas conduce a un uso de memoria previamente liberada en Skia en Google Chrome en versiones anteriores a la 71.0.3578.80 permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante una página HTML manipulada. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00043.html http://www.securityfocus.com/bid/106084 https://access.redhat.com/errata/RHSA-2018:3803 https://access.redhat.com/errata/RHSA-2019:0373 https://access.redhat.com/errata/RHSA-2019:0374 https://access.redhat.com/errata/RHSA-2019:1144 https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html https://crbug.com/883666 https://lists.debian.org/debian-lts-announce/2019/02/msg00023.html h • CWE-190: Integer Overflow or Wraparound CWE-416: Use After Free CWE-787: Out-of-bounds Write •