CVSS: 6.8EPSS: 1%CPEs: 49EXPL: 0CVE-2010-0661
https://notcve.org/view.php?id=CVE-2010-0661
WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp in WebKit before r52401, as used in Google Chrome before 4.0.249.78, allows remote attackers to bypass the Same Origin Policy via vectors involving the window.open method. WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp en WebKit anterior a r52401 , usado en Google Chrome, anterior a v4.0.249.78, permite a atacantes remotos saltar la política de mismo origen (Same Origin Policy) a través de vectores que implica el método window.open. • http://code.google.com/p/chromium/issues/detail?id=30660 http://flock.com/security http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://secunia.com/advisories/43068 http://securitytracker.com/id?1023506 http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs http://trac.webkit.org/changeset/52401 http://www.vupen.com/english/advisories/2011/0212 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 47EXPL: 0CVE-2010-0643
https://notcve.org/view.php?id=CVE-2010-0643
Google Chrome before 4.0.249.89 attempts to make direct connections to web sites when all configured proxy servers are unavailable, which allows remote HTTP servers to obtain potentially sensitive information about the identity of a client user via standard HTTP logging, as demonstrated by a proxy server that was configured for the purpose of anonymity. Google Chrome anterior v4.0.249.89 intenta a establecer conexiones con sitios web cuando todas las configuraciones de los servidores proxy no están disponibles, permitiendo a servidores HTTP remotos atacar para obtener información potencialmente sensible sobre la identidad de usuarios clientes a través de un logueo HTTP standard, como quedó demostrado con el servidor proxy que fue configurado para tal propósito de anonimato. • http://code.google.com/p/chromium/issues/detail?id=12303 http://googlechromereleases.blogspot.com/2010/02/stable-channel-update.html http://secunia.com/advisories/38545 http://securitytracker.com/id?1023583 http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs http://www.osvdb.org/62315 http://www.securityfocus.com/bid/38177 http://www.vupen.com/english/advisories/2010/0361 https://exchange.xforce.ibmcloud.com/vulnerabilities/56212 https://oval.cis • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 4%CPEs: 47EXPL: 0CVE-2010-0645
https://notcve.org/view.php?id=CVE-2010-0645
Multiple integer overflows in factory.cc in Google V8 before r3560, as used in Google Chrome before 4.0.249.89, allow remote attackers to execute arbitrary code in the Chrome sandbox via crafted use of JavaScript arrays. Multiples errores de enteros sin signo en factory.cc en Google V8 anterior r3560, como el usado en Google Chrome anterior v4.0.249.89, permite a atacantes remotos ejecutar código arbitrario en el Sandbox de Chrome a través de un uso manipulado de arrays JavaScript. • http://code.google.com/p/chromium/issues/detail?id=31009 http://code.google.com/p/v8/source/detail?r=3560 http://codereview.chromium.org/525064 http://googlechromereleases.blogspot.com/2010/02/stable-channel-update.html http://secunia.com/advisories/38545 http://securitytracker.com/id?1023583 http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs http://www.osvdb.org/62316 http://www.securityfocus.com/bid/38177 http://www.vupen.com/english&# • CWE-189: Numeric Errors •
CVSS: 9.3EPSS: 8%CPEs: 49EXPL: 0CVE-2010-0659
https://notcve.org/view.php?id=CVE-2010-0659
The image decoder in WebKit before r52833, as used in Google Chrome before 4.0.249.78, does not properly handle a failure of memory allocation, which allows remote attackers to execute arbitrary code in the Chrome sandbox via a malformed GIF file that specifies a large size. El decodificador de imagen en WebKit anterior a r52833, usado en Google Chrome anterior a v4.0.249.78, no controla correctamente un error de asignación de memoria, lo cual permite a atacantes remotos ejecutar código arbitrario en el recinto de seguridad de Chrome (sandbox) a través de un archivo GIF malformado que especifica un tamaño grande . • http://code.google.com/p/chromium/issues/detail?id=28566 http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://secunia.com/advisories/43068 http://securitytracker.com/id?1023506 http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs http://trac.webkit.org/changeset/52833 http://www.vupen.com/english/advisories/2011/0212 https://bugs.webkit.org/s • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 0%CPEs: 47EXPL: 0CVE-2010-0662
https://notcve.org/view.php?id=CVE-2010-0662
The ParamTraits<SkBitmap>::Read function in common/common_param_traits.cc in Google Chrome before 4.0.249.78 does not use the correct variables in calculations designed to prevent integer overflows, which allows attackers to leverage renderer access to cause a denial of service or possibly have unspecified other impact via bitmap data, related to deserialization. La función ParamTraits<SkBitmap>::Read en common/common_param_traits.cc en Google Chrome anterior a v4.0.249.78 no utiliza las variables correctas en los cálculos diseñados para prevenir desbordamientos de enteros, lo que permite a los atacantes acceder al renderizador para causar una denegación de servicio o posiblemente otro impacto no especificado a través de los datos de mapa de bits, en relación con deserialización. • http://code.google.com/p/chromium/issues/detail?id=31307 http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html http://securitytracker.com/id?1023506 http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs https://exchange.xforce.ibmcloud.com/vulnerabilities/56627 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14457 • CWE-189: Numeric Errors •