rpm package

opensuse/chromium&distro=openSUSE Tumbleweed

pkg:rpm/opensuse/chromium&distro=openSUSE%20Tumbleweed

Vulnerabilities (4,053)

CVE	Sev	CVSS	KEV	Affected versions	Fixed in	Published	Description
CVE-2016-5206	Hig	8.8		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Jan 19, 2017	The PDF plugin in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly followed redirects, which allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page.
CVE-2016-5205	Med	6.1		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Jan 19, 2017	Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac, incorrectly handles deferred page loads, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
CVE-2016-5204	Med	6.1		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Jan 19, 2017	Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
CVE-2016-5203	Hig	8.8		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Jan 19, 2017	A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVE-2016-5201	Med	6.5		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Jan 19, 2017	A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.2840.99 for Windows, and 54.0.2840.98 for Mac allowed a remote attacker to access privileged JavaScript code via a crafted HTML page.
CVE-2016-5200	Hig	8.8		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Jan 19, 2017	V8 in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android incorrectly applied type rules, which allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2016-5199	Hig	8.8		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Jan 19, 2017	An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a cra
CVE-2016-5198	Hig	8.8	KEV	< 55.0.2883.75-3.1	55.0.2883.75-3.1	Jan 19, 2017	V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code execution, via a crafte
CVE-2016-5193	Med	4.3		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Dec 18, 2016	Google Chrome prior to 54.0 for iOS had insufficient validation of URLs for windows open by DOM, which allowed a remote attacker to bypass restrictions on navigation to certain URL schemes via crafted HTML pages.
CVE-2016-5192	Med	6.5		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Dec 18, 2016	Blink in Google Chrome prior to 54.0.2840.59 for Windows missed a CORS check on redirect in TextTrackLoader, which allowed a remote attacker to bypass cross-origin restrictions via crafted HTML pages.
CVE-2016-5191	Med	6.1		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Dec 18, 2016	Bookmark handling in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation of supplied data, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages, as demonstrated by an in
CVE-2016-5190	Med	6.3		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Dec 18, 2016	Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles during shutdown, which allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages.
CVE-2016-5189	Med	6.5		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Dec 18, 2016	Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted navigation to blob URLs with non-canonical origins, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages.
CVE-2016-5188	Med	4.3		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Dec 18, 2016	Multiple issues in Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux allow a remote attacker to spoof various parts of browser UI via crafted HTML pages.
CVE-2016-5187	Med	6.5		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Dec 18, 2016	Google Chrome prior to 54.0.2840.85 for Android incorrectly handled rapid transition into and out of full screen mode, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages.
CVE-2016-5186	Med	5.3		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Dec 18, 2016	Devtools in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled objects after a tab crash, which allowed a remote attacker to perform an out of bounds memory read via crafted PDF files.
CVE-2016-5185	Hig	8.8		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Dec 18, 2016	Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly allowed reentrance of FrameView::updateLifecyclePhasesInternal(), which allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages.
CVE-2016-5184	Hig	8.8		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Dec 18, 2016	PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles in CFFL_FormFillter::KillFocusForAnnot, which allowed a remote attacker to potentially exploit heap corruption via crafted PDF files.
CVE-2016-5183	Hig	8.8		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Dec 18, 2016	A heap use after free in PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android allows a remote attacker to potentially exploit heap corruption via crafted PDF files.
CVE-2016-5182	Hig	8.8		< 55.0.2883.75-3.1	55.0.2883.75-3.1	Dec 18, 2016	Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation in bitmap handling, which allowed a remote attacker to potentially exploit heap corruption via crafted HTML pages.

CVE-2016-5206HigJan 19, 2017
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
The PDF plugin in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly followed redirects, which allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page.
CVE-2016-5205MedJan 19, 2017
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac, incorrectly handles deferred page loads, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
CVE-2016-5204MedJan 19, 2017
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
CVE-2016-5203HigJan 19, 2017
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVE-2016-5201MedJan 19, 2017
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.2840.99 for Windows, and 54.0.2840.98 for Mac allowed a remote attacker to access privileged JavaScript code via a crafted HTML page.
CVE-2016-5200HigJan 19, 2017
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
V8 in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android incorrectly applied type rules, which allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2016-5199HigJan 19, 2017
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a cra
CVE-2016-5198HigKEVJan 19, 2017
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code execution, via a crafte
CVE-2016-5193MedDec 18, 2016
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Google Chrome prior to 54.0 for iOS had insufficient validation of URLs for windows open by DOM, which allowed a remote attacker to bypass restrictions on navigation to certain URL schemes via crafted HTML pages.
CVE-2016-5192MedDec 18, 2016
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Blink in Google Chrome prior to 54.0.2840.59 for Windows missed a CORS check on redirect in TextTrackLoader, which allowed a remote attacker to bypass cross-origin restrictions via crafted HTML pages.
CVE-2016-5191MedDec 18, 2016
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Bookmark handling in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation of supplied data, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages, as demonstrated by an in
CVE-2016-5190MedDec 18, 2016
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles during shutdown, which allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages.
CVE-2016-5189MedDec 18, 2016
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted navigation to blob URLs with non-canonical origins, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages.
CVE-2016-5188MedDec 18, 2016
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Multiple issues in Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux allow a remote attacker to spoof various parts of browser UI via crafted HTML pages.
CVE-2016-5187MedDec 18, 2016
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Google Chrome prior to 54.0.2840.85 for Android incorrectly handled rapid transition into and out of full screen mode, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages.
CVE-2016-5186MedDec 18, 2016
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Devtools in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled objects after a tab crash, which allowed a remote attacker to perform an out of bounds memory read via crafted PDF files.
CVE-2016-5185HigDec 18, 2016
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly allowed reentrance of FrameView::updateLifecyclePhasesInternal(), which allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages.
CVE-2016-5184HigDec 18, 2016
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles in CFFL_FormFillter::KillFocusForAnnot, which allowed a remote attacker to potentially exploit heap corruption via crafted PDF files.
CVE-2016-5183HigDec 18, 2016
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
A heap use after free in PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android allows a remote attacker to potentially exploit heap corruption via crafted PDF files.
CVE-2016-5182HigDec 18, 2016
affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation in bitmap handling, which allowed a remote attacker to potentially exploit heap corruption via crafted HTML pages.

Page 169 of 203