CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2017-5066 – chromium-browser: incorrect signature handing in networking
https://notcve.org/view.php?id=CVE-2017-5066
Insufficient consistency checks in signature handling in the networking stack in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to incorrectly accept a badly formed X.509 certificate via a crafted HTML page. Verificaciones insuficientes de consistencia en la manipulación de firmas en la pila de red en Google Chrome, en versiones anteriores a la 58.0.3029.81 para Mac, Windows y Linux y a la 58.0.3029.83 para Android, permitían que un atacante remoto aceptase un certificado X.509 mal formado mediante una página HTML manipulada. • http://www.securityfocus.com/bid/97939 http://www.securitytracker.com/id/1038317 https://access.redhat.com/errata/RHSA-2017:1124 https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html https://crbug.com/690821 https://security.gentoo.org/glsa/201705-02 https://access.redhat.com/security/cve/CVE-2017-5066 https://bugzilla.redhat.com/show_bug.cgi?id=1443848 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2017-5061 – chromium-browser: url spoofing in omnibox
https://notcve.org/view.php?id=CVE-2017-5061
A race condition in navigation in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. Una condición de carrera en navigation en Google Chrome, en versiones anteriores a la 58.0.3029.81 para Linux, Windows y Mac, permitía que un atacante remoto suplantase el contenido de la Omnibox (barra de direcciones) mediante una página HTML manipulada. • http://www.securityfocus.com/bid/97939 http://www.securitytracker.com/id/1038317 https://access.redhat.com/errata/RHSA-2017:1124 https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html https://crbug.com/672847 https://security.gentoo.org/glsa/201705-02 https://access.redhat.com/security/cve/CVE-2017-5061 https://bugzilla.redhat.com/show_bug.cgi?id=1443839 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.1EPSS: 0%CPEs: 9EXPL: 0CVE-2017-5069 – chromium-browser: cross-origin bypass in blink
https://notcve.org/view.php?id=CVE-2017-5069
Incorrect MIME type of XSS-Protection reports in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to circumvent Cross-Origin Resource Sharing checks via a crafted HTML page. Un tipo MIME incorrecto de informes XSS-Protection en Blink en Google Chrome, en versiones anteriores a la 58.0.3029.81 para Linux, Windows y Mac y a la 58.0.3029.83 para Android, permitía que un atacante remoto sortease las comprobaciones Cross-Origin Resource Sharing mediante una página HTML manipulada. • http://www.securityfocus.com/bid/97939 http://www.securitytracker.com/id/1038317 https://access.redhat.com/errata/RHSA-2017:1124 https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html https://crbug.com/691726 https://security.gentoo.org/glsa/201705-02 https://access.redhat.com/security/cve/CVE-2017-5069 https://bugzilla.redhat.com/show_bug.cgi?id=1443850 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 1%CPEs: 9EXPL: 0CVE-2017-5062 – chromium-browser: use after free in chrome apps
https://notcve.org/view.php?id=CVE-2017-5062
A use after free in Chrome Apps in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to potentially perform out of bounds memory access via a crafted Chrome extension. Un uso de memoria previamente liberada en Chrome Apps en Google Chrome, en versiones anteriores a la 58.0.3029.81 para Mac, Windows y Linux y a la 58.0.3029.83 para Android, permitía que un atacante remoto pudiese realizar un acceso a la memoria fuera de límites mediante una extensión de Chrome manipulada. • http://www.securityfocus.com/bid/97939 http://www.securitytracker.com/id/1038317 https://access.redhat.com/errata/RHSA-2017:1124 https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html https://crbug.com/702896 https://security.gentoo.org/glsa/201705-02 https://access.redhat.com/security/cve/CVE-2017-5062 https://bugzilla.redhat.com/show_bug.cgi?id=1443840 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 16%CPEs: 9EXPL: 0CVE-2017-5059 – Google Chrome List Item Marker Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-5059
Type confusion in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to potentially obtain code execution via a crafted HTML page. Una confusión de tipos en Blink en Google Chrome, en versiones anteriores a la 58.0.3029.81 para Linux, Windows y Mac y a la 58.0.3029.83 para Android, permitía que un atacante remoto pudiese ejecutar código mediante una página HTML manipulada. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Google Chrome. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of list item markers. It's possible to trigger a type confusion condition by manipulating a document's elements. • http://www.securityfocus.com/bid/97939 http://www.securitytracker.com/id/1038317 https://access.redhat.com/errata/RHSA-2017:1124 https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html https://crbug.com/684684 https://security.gentoo.org/glsa/201705-02 https://access.redhat.com/security/cve/CVE-2017-5059 https://bugzilla.redhat.com/show_bug.cgi?id=1443837 • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •