rpm package
suse/chromium&distro=SUSE Package Hub 12 SP2
pkg:rpm/suse/chromium&distro=SUSE%20Package%20Hub%2012%20SP2
Vulnerabilities (343)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2017-5070 | Hig | 8.8 | KEV | < 59.0.3071.86-20.1 | 59.0.3071.86-20.1 | Oct 27, 2017 | Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
| CVE-2017-5069 | Med | 6.1 | < 58.0.3029.81-14.1 | 58.0.3029.81-14.1 | Oct 27, 2017 | Incorrect MIME type of XSS-Protection reports in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to circumvent Cross-Origin Resource Sharing checks via a crafted HTML page. | |
| CVE-2017-5068 | Hig | 7.5 | < 58.0.3029.96-17.1 | 58.0.3029.96-17.1 | Oct 27, 2017 | Incorrect handling of picture ID in WebRTC in Google Chrome prior to 58.0.3029.96 for Mac, Windows, and Linux allowed a remote attacker to trigger a race condition via a crafted HTML page. | |
| CVE-2017-5067 | Med | 6.5 | < 58.0.3029.81-14.1 | 58.0.3029.81-14.1 | Oct 27, 2017 | An insufficient watchdog timer in navigation in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. | |
| CVE-2017-5066 | Med | 6.5 | < 58.0.3029.81-14.1 | 58.0.3029.81-14.1 | Oct 27, 2017 | Insufficient consistency checks in signature handling in the networking stack in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to incorrectly accept a badly formed X.509 certificate via a crafted HTML page | |
| CVE-2017-5065 | Med | 4.7 | < 58.0.3029.81-14.1 | 58.0.3029.81-14.1 | Oct 27, 2017 | Lack of an appropriate action on page navigation in Blink in Google Chrome prior to 58.0.3029.81 for Windows and Mac allowed a remote attacker to potentially confuse a user into making an incorrect security decision via a crafted HTML page. | |
| CVE-2017-5064 | Hig | 8.8 | < 58.0.3029.81-14.1 | 58.0.3029.81-14.1 | Oct 27, 2017 | Incorrect handling of DOM changes in Blink in Google Chrome prior to 58.0.3029.81 for Windows allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2017-5063 | Hig | 8.8 | < 58.0.3029.81-14.1 | 58.0.3029.81-14.1 | Oct 27, 2017 | A numeric overflow in Skia in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. | |
| CVE-2017-5062 | Hig | 8.8 | < 58.0.3029.81-14.1 | 58.0.3029.81-14.1 | Oct 27, 2017 | A use after free in Chrome Apps in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to potentially perform out of bounds memory access via a crafted Chrome extension. | |
| CVE-2017-5061 | Med | 5.3 | < 58.0.3029.81-14.1 | 58.0.3029.81-14.1 | Oct 27, 2017 | A race condition in navigation in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. | |
| CVE-2017-5060 | Med | 6.5 | < 58.0.3029.81-14.1 | 58.0.3029.81-14.1 | Oct 27, 2017 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. | |
| CVE-2017-5059 | Hig | 8.8 | < 58.0.3029.81-14.1 | 58.0.3029.81-14.1 | Oct 27, 2017 | Type confusion in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to potentially obtain code execution via a crafted HTML page. | |
| CVE-2017-5058 | Hig | 8.8 | < 58.0.3029.81-14.1 | 58.0.3029.81-14.1 | Oct 27, 2017 | A use after free in PrintPreview in Google Chrome prior to 58.0.3029.81 for Windows allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. | |
| CVE-2017-5057 | Hig | 8.8 | < 58.0.3029.81-14.1 | 58.0.3029.81-14.1 | Oct 27, 2017 | Type confusion in PDFium in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. | |
| CVE-2017-5056 | Hig | 8.8 | < 57.0.2987.133-11.1 | 57.0.2987.133-11.1 | Oct 27, 2017 | A use after free in Blink in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. | |
| CVE-2017-5055 | Hig | 8.8 | < 57.0.2987.133-11.1 | 57.0.2987.133-11.1 | Oct 27, 2017 | A use after free in printing in Google Chrome prior to 57.0.2987.133 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. | |
| CVE-2017-5054 | Hig | 8.8 | < 57.0.2987.133-11.1 | 57.0.2987.133-11.1 | Oct 27, 2017 | An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to obtain heap memory contents via a crafted HTML page. | |
| CVE-2017-5053 | Cri | 9.6 | < 57.0.2987.133-11.1 | 57.0.2987.133-11.1 | Oct 27, 2017 | An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to Array.prototype.indexOf. | |
| CVE-2017-5052 | Hig | 8.8 | < 57.0.2987.133-11.1 | 57.0.2987.133-11.1 | Oct 27, 2017 | An incorrect assumption about block structure in Blink in Google Chrome prior to 57.0.2987.133 for Mac, Windows, and Linux, and 57.0.2987.132 for Android, allowed a remote attacker to potentially exploit memory corruption via a crafted HTML page that triggers improper casting. | |
| CVE-2017-5046 | Med | 4.3 | < 57.0.2987.98-8.1 | 57.0.2987.98-8.1 | Apr 24, 2017 | V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android had insufficient policy enforcement, which allowed a remote attacker to spoof the location object via a crafted HTML page, related to Blink information disclosure. |
- affected < 59.0.3071.86-20.1fixed 59.0.3071.86-20.1
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- affected < 58.0.3029.81-14.1fixed 58.0.3029.81-14.1
Incorrect MIME type of XSS-Protection reports in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to circumvent Cross-Origin Resource Sharing checks via a crafted HTML page.
- affected < 58.0.3029.96-17.1fixed 58.0.3029.96-17.1
Incorrect handling of picture ID in WebRTC in Google Chrome prior to 58.0.3029.96 for Mac, Windows, and Linux allowed a remote attacker to trigger a race condition via a crafted HTML page.
- affected < 58.0.3029.81-14.1fixed 58.0.3029.81-14.1
An insufficient watchdog timer in navigation in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
- affected < 58.0.3029.81-14.1fixed 58.0.3029.81-14.1
Insufficient consistency checks in signature handling in the networking stack in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to incorrectly accept a badly formed X.509 certificate via a crafted HTML page
- affected < 58.0.3029.81-14.1fixed 58.0.3029.81-14.1
Lack of an appropriate action on page navigation in Blink in Google Chrome prior to 58.0.3029.81 for Windows and Mac allowed a remote attacker to potentially confuse a user into making an incorrect security decision via a crafted HTML page.
- affected < 58.0.3029.81-14.1fixed 58.0.3029.81-14.1
Incorrect handling of DOM changes in Blink in Google Chrome prior to 58.0.3029.81 for Windows allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- affected < 58.0.3029.81-14.1fixed 58.0.3029.81-14.1
A numeric overflow in Skia in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
- affected < 58.0.3029.81-14.1fixed 58.0.3029.81-14.1
A use after free in Chrome Apps in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to potentially perform out of bounds memory access via a crafted Chrome extension.
- affected < 58.0.3029.81-14.1fixed 58.0.3029.81-14.1
A race condition in navigation in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
- affected < 58.0.3029.81-14.1fixed 58.0.3029.81-14.1
Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
- affected < 58.0.3029.81-14.1fixed 58.0.3029.81-14.1
Type confusion in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to potentially obtain code execution via a crafted HTML page.
- affected < 58.0.3029.81-14.1fixed 58.0.3029.81-14.1
A use after free in PrintPreview in Google Chrome prior to 58.0.3029.81 for Windows allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
- affected < 58.0.3029.81-14.1fixed 58.0.3029.81-14.1
Type confusion in PDFium in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
- affected < 57.0.2987.133-11.1fixed 57.0.2987.133-11.1
A use after free in Blink in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
- affected < 57.0.2987.133-11.1fixed 57.0.2987.133-11.1
A use after free in printing in Google Chrome prior to 57.0.2987.133 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
- affected < 57.0.2987.133-11.1fixed 57.0.2987.133-11.1
An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to obtain heap memory contents via a crafted HTML page.
- affected < 57.0.2987.133-11.1fixed 57.0.2987.133-11.1
An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to Array.prototype.indexOf.
- affected < 57.0.2987.133-11.1fixed 57.0.2987.133-11.1
An incorrect assumption about block structure in Blink in Google Chrome prior to 57.0.2987.133 for Mac, Windows, and Linux, and 57.0.2987.132 for Android, allowed a remote attacker to potentially exploit memory corruption via a crafted HTML page that triggers improper casting.
- affected < 57.0.2987.98-8.1fixed 57.0.2987.98-8.1
V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android had insufficient policy enforcement, which allowed a remote attacker to spoof the location object via a crafted HTML page, related to Blink information disclosure.
Page 14 of 18