CVE-2018-6047

chromium-browser: cross origin url leak in webgl

Insufficient policy enforcement in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user redirect URL via a crafted HTML page.

CVSS 3.0 · 4.3 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6046

chromium-browser: insufficient isolation of devtools from extensions

Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted Chrome Extension.

CVSS 3.0 · 6.1 Medium EPSS 1.2% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6045

chromium-browser: insufficient isolation of devtools from extensions

Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local file data via a crafted Chrome Extension.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6043

chromium-browser: insufficient escaping with external url handlers

Insufficient data validation in External Protocol Handler in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially execute arbitrary programs on user machine via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6042

chromium-browser: url spoof in omnibox

Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVSS 3.0 · 4.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6041

chromium-browser: url spoof in navigation

Incorrect security UI in navigation in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVSS 3.0 · 4.3 Medium EPSS 1.3% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6040

chromium-browser: content security policy bypass

Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially bypass content security policy via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6039

chromium-browser: xss in devtools

Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted Chrome Extension.

CVSS 3.0 · 6.1 Medium EPSS 1.2% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6038

chromium-browser: heap buffer overflow in webgl

Heap buffer overflow in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6037

chromium-browser: insufficient user gesture requirements in autofill

Inappropriate implementation in autofill in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain autofill data with insufficient user gestures via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.6% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6036

chromium-browser: integer underflow in webassembly

Insufficient data validation in V8 in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user data via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.6% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6035

chromium-browser: insufficient isolation of devtools from extensions

Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local file data via a crafted Chrome Extension.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6034

chromium-browser: integer overflow in blink

Insufficient data validation in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.0 · 8.1 High EPSS 1.9% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6033

chromium-browser: race when opening downloaded files

Insufficient data validation in Downloads in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside sandbox via a crafted Chrome Extension.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6032

chromium-browser: same origin bypass in shared worker

Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6031

chromium-browser: use after free in pdfium

Use after free in PDFium in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

CVSS 3.0 · 8.8 High EPSS 2.1% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-5950

mailman: Cross-site scripting (XSS) vulnerability in web UI

Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL.

CVSS 3.1 · 6.1 Medium EPSS 4.6% KEV · Not listed

Vendors

Canonical Debian Gnu and 1 more

Products

Ubuntu Linux Debian Linux Mailman and 7 more

CVE-2018-5848

kernel: buffer overflow in drivers/net/wireless/ath/wil6210/wmi.c:wmi_set_ie() may lead to memory corruption

In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Google Redhat

Products

Debian Linux Android Enterprise Linux and 5 more

CVE-2018-5806

LibRaw: NULL pointer dereference in leaf_hdr_load_raw() function in internal/dcraw_common.cpp

An error within the "leaf_hdr_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to trigger a NULL pointer dereference.

CVSS 3.0 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Libraw Redhat

Products

Libraw Enterprise Linux Enterprise Linux Desktop and 2 more

CVE-2018-5805

LibRaw: Stack-based buffer overflow in quicktake_100_load_raw() function in internal/dcraw_common.cpp

A boundary error within the "quicktake_100_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to cause a stack-based buffer overflow and subsequently cause a crash.

CVSS 3.0 · 8.8 High EPSS 2.0% KEV · Not listed

Vendors

Libraw Redhat

Products

Libraw Enterprise Linux Enterprise Linux Desktop and 2 more