Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8,163

Export CSV
CVE-2015-1234

chromium-browser: buffer overflow via race condition in GPU

Race condition in gpu/command_buffer/service/gles2_cmd_decoder.cc in Google Chrome before 41.0.2272.118 allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact by manipulating OpenGL ES commands.

CVSS 2.0 · 6.8 Medium EPSS 1.5% KEV · Not listed
Vendors
Apple Google Linux and 2 more
Products
Macos Chrome Linux Kernel and 2 more
CVE-2015-1235

chromium-browser: Cross-origin-bypass in HTML parser

The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in the HTML parser in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy via a crafted HTML document with an IFRAME element.

CVSS 2.0 · 5.0 Medium EPSS 1.6% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Chrome and 1 more
CVE-2015-1236

chromium-browser: Cross-origin-bypass in Blink

The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a crafted web site containing a media element.

CVSS 2.0 · 4.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Chrome and 1 more
CVE-2015-1237

chromium-browser: Use-after-free in IPC

Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in content/renderer/render_frame_impl.cc in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages during a detach operation.

CVSS 2.0 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Chrome and 1 more
CVE-2015-1238

chromium-browser: Out-of-bounds write in Skia

Skia, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Chrome and 1 more
CVE-2015-1240

chromium-browser: Out-of-bounds read in WebGL

gpu/blink/webgraphicscontext3d_impl.cc in the WebGL implementation in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WebGL program that triggers a state inconsistency.

CVSS 2.0 · 5.0 Medium EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Chrome and 1 more
CVE-2015-1247

chromium-browser: Scheme issues in OpenSearch

The SearchEngineTabHelper::OnPageHasOSDD function in browser/ui/search_engines/search_engine_tab_helper.cc in Google Chrome before 42.0.2311.90 does not prevent use of a file: URL for an OpenSearch descriptor XML document, which might allow remote attackers to obtain sensitive information from local files via a crafted (1) http or (2) https web site.

CVSS 2.0 · 5.0 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-1241

chromium-browser: tap-jacking vulnerability

Google Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation with the handling of touch events and gesture events, which allows remote attackers to trigger unintended UI actions via a crafted web site that conducts a "tapjacking" attack.

CVSS 2.0 · 4.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Google and 3 more
Products
Ubuntu Linux Debian Linux Chrome and 9 more
CVE-2015-1242

chromium-browser: Type confusion in V8

The ReduceTransitionElementsKind function in hydrogen-check-elimination.cc in Google V8 before 4.2.77.8, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that leverages "type confusion" in the check-elimination optimization.

CVSS 2.0 · 7.5 High EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Chrome and 2 more
CVE-2015-1243

chromium-browser: use-after-free in DOM

Use-after-free vulnerability in the MutationObserver::disconnect function in core/dom/MutationObserver.cpp in the DOM implementation in Blink, as used in Google Chrome before 42.0.2311.135, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an attempt to unregister a MutationObserver object that is not currently registered.

CVSS 2.0 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Chrome and 5 more
CVE-2015-1244

chromium-browser: HSTS bypass in WebSockets

The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for WebSocket traffic.

CVSS 2.0 · 5.0 Medium EPSS 1.4% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Chrome and 1 more
CVE-2015-1245

chromium-browser: Use-after-free in PDFium

Use-after-free vulnerability in the OpenPDFInReaderView::Update function in browser/ui/views/location_bar/open_pdf_in_reader_view.cc in Google Chrome before 41.0.2272.76 might allow user-assisted remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by triggering interaction with a PDFium "Open PDF in Reader" button that has an invalid tab association.

CVSS 2.0 · 6.8 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-1246

chromium-browser: Out-of-bounds read in Blink

Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 1.6% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-1248

chromium-browser: SafeBrowsing bypass

The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the SafeBrowsing for Executable Files protection mechanism by creating a .exe file in a temporary filesystem and then referencing this file with a filesystem:http: URL.

CVSS 2.0 · 4.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-1249

chromium-browser: Various fixes from internal audits, fuzzing and other initiatives

Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.90 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Chrome and 1 more
CVE-2015-1250

chromium-browser: various unspecified flaws

Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Chrome and 5 more
CVE-2015-1251

chromium-browser: Use-after-free in Speech.

Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem in Google Chrome before 43.0.2357.65 allows remote attackers to execute arbitrary code via a crafted document.

CVSS 2.0 · 6.8 Medium EPSS 2.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-1252

chromium-browser: Sandbox escape in Chrome.

common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions.

CVSS 2.0 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-1253

chromium-browser: Cross-origin bypass in DOM.

core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions.

CVSS 2.0 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-1254

chromium-browser: Cross-origin bypass in Editing.

core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing.

CVSS 2.0 · 5.0 Medium EPSS 1.6% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras