CVE-2019-13674

chromium-browser: IDN spoofing

IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2019-13673

chromium-browser: Cross-origin information leak using devtools

Insufficient data validation in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2019-13671

chromium-browser: Dialog box fails to show origin

UI spoofing in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof security UI via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2019-13670

chromium-browser: V8 memory corruption in regex

Insufficient data validation in JavaScript in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2019-13669

chromium-browser: HTTP authentication spoof

Incorrect data validation in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2019-13668

chromium-browser: Global window leak via console

Insufficient policy enforcement in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2019-13667

chromium-browser: URI bar spoof when using external app URIs

Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google Redhat

Products

Iphone Os Chrome Rhel Extras

CVE-2019-13666

chromium-browser: Side channel using storage size estimate

Information leak in storage in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2019-13665

chromium-browser: Multiple file download protection bypass

Insufficient filtering in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass multiple file download protection via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2019-13664

chromium-browser: CSRF bypass

Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2019-13663

chromium-browser: IDN spoof

IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2019-13662

chromium-browser: CSP bypass

Insufficient policy enforcement in navigations in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2019-13661

chromium-browser: Full screen notification spoof

UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2019-13660

chromium-browser: Full screen notification overlap

UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2019-13659

chromium-browser: URL spoof

IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2019-13233

kernel: use-after-free in arch/x86/lib/insn-eval.c

In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds violation.

CVSS 3.0 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus and 1 more

CVE-2019-13139

docker: command injection due to a missing validation of the git ref command

In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "docker build" processes remote git URLs, and results in command injection into the underlying "git clone" command, leading to code execution in the context of the user executing the "docker build" command. This occurs because git ref can be misinterpreted as a flag.

CVSS 3.0 · 8.4 High EPSS 2.0% KEV · Not listed

Vendors

Docker Redhat

Products

Docker Rhel Extras Other

CVE-2019-12382

kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service

An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel through 5.1.5. There is an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: The vendor disputes this issues as not being a vulnerability because kstrdup() returning NULL is handled sufficiently and there is no chance for a NULL pointer dereference

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus and 1 more

CVE-2019-11884

kernel: sensitive information disclosure from kernel stack memory via HIDPCONNADD command

The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not end with a '\0' character.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 10 more

CVE-2019-11833

kernel: fs/ext4/extents.c leads to information disclosure

fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 13 more