CVE-2017-5109

chromium-browser: ui spoofing in browser

Inappropriate implementation of unload handler handling in permission prompts in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to display UI on a non attacker controlled tab via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Chrome and 6 more

CVE-2017-5121

chromium-browser: out-of-bounds access in v8

Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.

CVSS 3.1 · 8.8 High EPSS 5.3% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Chrome and 6 more

CVE-2017-5095

chromium-browser: out-of-bounds write in pdfium

Stack overflow in PDFium in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to potentially exploit stack corruption via a crafted PDF file.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Chrome and 6 more

CVE-2017-5091

chromium-browser: use after free in indexeddb

A use after free in IndexedDB in Google Chrome prior to 60.0.3112.78 for Linux, Android, Windows, and Mac allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5098

chromium-browser: use after free in v8

A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 15.5% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5086

chromium-browser: address spoofing in omnibox

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.86 for Windows and Mac allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Apple Google Microsoft and 1 more

Products

Macos Chrome Windows and 4 more

CVE-2015-8896

ImageMagick: Integer truncation vulnerability in coders/pict.c

Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted .pict file.

CVSS 3.1 · 6.5 Medium EPSS 2.9% KEV · Not listed

Vendors

Imagemagick Oracle Redhat

Products

Imagemagick Linux Enterprise Linux and 6 more

CVE-2017-5081

chromium-browser: extension verification bypass

Lack of verification of an extension's locale folder in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed an attacker with local write access to modify extensions by modifying extension files.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5087

chromium-browser: sandbox escape in indexeddb

A use after free in Blink in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page, aka an IndexedDB sandbox escape.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5100

chromium-browser: use after free in chrome apps

A use after free in Apps in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Debian Google Microsoft and 1 more

Products

Debian Linux Chrome Windows and 4 more

CVE-2017-5076

chromium-browser: address spoofing in omnibox

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5075

chromium-browser: information leak in csp reporting

Inappropriate implementation in CSP reporting in Blink in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to obtain the value of url fragments via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5077

chromium-browser: heap buffer overflow in skia

Insufficient validation of untrusted input in Skia in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 2.6% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5083

chromium-browser: ui spoofing in blink

Inappropriate implementation in Blink in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote attacker to display UI on a non attacker controlled tab via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5073

chromium-browser: use after free in print preview

Use after free in print preview in Blink in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5088

chromium-browser: out of bounds read in v8

Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 3.2% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5093

chromium-browser: ui spoofing in blink

Inappropriate implementation in modal dialog handling in Blink in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to prevent a full screen warning from being displayed via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5094

chromium-browser: type confusion in extensions

Type confusion in extensions JavaScript bindings in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5078

chromium-browser: possible command injection in mailto handling

Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as * have an incorrect interaction with xdg-email in xdg-utils, and a space character can be used in front of a command-line argument.

CVSS 3.1 · 8.8 High EPSS 2.8% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Chrome Linux Kernel and 5 more

CVE-2017-5069

chromium-browser: cross-origin bypass in blink

Incorrect MIME type of XSS-Protection reports in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to circumvent Cross-Origin Resource Sharing checks via a crafted HTML page.

CVSS 3.1 · 6.1 Medium EPSS 1.2% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more