CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-19333
https://notcve.org/view.php?id=CVE-2018-19333
pkg/sentry/kernel/shm/shm.go in Google gVisor before 2018-11-01 allows attackers to overwrite memory locations in processes running as root (but not escape the sandbox) via vectors involving IPC_RMID shmctl calls, because reference counting is mishandled. pkg/sentry/kernel/shm/shm.go en Google gVisor en versiones anteriores a la 2018-11-01 permite que los atacantes sobrescriban ubicaciones de memoria en procesos que se ejecutan como root (pero que no escapan del sandbox) mediante vectores relacionados con las llamadas shmctl IPC_RMID. • https://github.com/google/gvisor/commit/0e277a39c8b6f905e289b75e8ad0594e6b3562ca https://justi.cz/security/2018/11/14/gvisor-lpe.html •
CVSS: 9.6EPSS: 0%CPEs: 6EXPL: 0CVE-2018-17472
https://notcve.org/view.php?id=CVE-2018-17472
Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to escape the <iframe> sandbox via a crafted HTML page. • http://www.securityfocus.com/bid/105666 https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html https://crbug.com/822518 https://security.gentoo.org/glsa/201811-10 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18748
https://notcve.org/view.php?id=CVE-2018-18748
Sandboxie 5.26 allows a Sandbox Escape via an "import os" statement, followed by os.system("cmd") or os.system("powershell"), within a .py file. NOTE: the vendor disputes this issue because the observed behavior is consistent with the product's intended functionality ** EN DISPUTA ** Sandboxie 5.26 permite el escape del sandbox mediante una instrucción "import os", seguida por os.system("cmd") u os.system("powershell"), en un archivo .py. • https://github.com/sandboxescape/Sandboxie-5.26-Sandbox-Escape-Exploit https://github.com/sandboxescape/Sandboxie-5.26-Sandbox-Escape-Exploit/blob/2632a5f7409e52b2e020f5d4467fa019f9095e73/README.doc •
CVSS: 9.6EPSS: 1%CPEs: 5EXPL: 0CVE-2018-17462 – chromium-browser: Sandbox escape in AppCache
https://notcve.org/view.php?id=CVE-2018-17462
Incorrect refcounting in AppCache in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform a sandbox escape via a crafted HTML page. Conteo de referencias incorrecto en AppCache en Google Chrome en versiones anteriores a la 70.0.3538.67 permitía que un atacante remoto realizase un escape del sandbox mediante una página HTML manipulada. • http://www.securityfocus.com/bid/105666 https://access.redhat.com/errata/RHSA-2018:3004 https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html https://crbug.com/888926 https://security.gentoo.org/glsa/201811-10 https://www.debian.org/security/2018/dsa-4330 https://access.redhat.com/security/cve/CVE-2018-17462 https://bugzilla.redhat.com/show_bug.cgi?id=1640098 • CWE-416: Use After Free •
CVSS: 7.4EPSS: 2%CPEs: 5EXPL: 0CVE-2018-17470 – chromium-browser: Memory corruption in GPU Internals
https://notcve.org/view.php?id=CVE-2018-17470
A heap buffer overflow in GPU in Google Chrome prior to 70.0.3538.67 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Un desbordamiento de búfer basado en memoria dinámica (heap) en GPU en Google Chrome, en versiones anteriores a la 70.0.3538.67, permitía que un atacante remoto, que hubiese comprometido el proceso renderer, pudiese escapar del sandbox mediante una página HTML manipulada. • http://www.securityfocus.com/bid/105666 https://access.redhat.com/errata/RHSA-2018:3004 https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html https://crbug.com/877874 https://security.gentoo.org/glsa/201811-10 https://www.debian.org/security/2018/dsa-4330 https://access.redhat.com/security/cve/CVE-2018-17470 https://bugzilla.redhat.com/show_bug.cgi?id=1640106 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •