rpm package
suse/chromium&distro=SUSE Package Hub 12 SP2
pkg:rpm/suse/chromium&distro=SUSE%20Package%20Hub%2012%20SP2
Vulnerabilities (343)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2017-5023 | Med | 4.3 | < 56.0.2924.87-5.1 | 56.0.2924.87-5.1 | Feb 17, 2017 | Type confusion in Histogram in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit a near null dereference via a crafted HTML page. | |
| CVE-2017-5022 | Med | 4.3 | < 56.0.2924.87-5.1 | 56.0.2924.87-5.1 | Feb 17, 2017 | Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to properly enforce unsafe-inline content security policy, which allowed a remote attacker to bypass content security policy via a crafted HTML page. | |
| CVE-2017-5021 | Med | 4.3 | < 56.0.2924.87-5.1 | 56.0.2924.87-5.1 | Feb 17, 2017 | A use after free in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. | |
| CVE-2017-5020 | Med | 6.1 | < 56.0.2924.87-5.1 | 56.0.2924.87-5.1 | Feb 17, 2017 | Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to require a user gesture for powerful download operations, which allowed a remote attacker who convinced a user to install a malicious extension to execute arbitrary code via a c | |
| CVE-2017-5019 | Med | 6.3 | < 56.0.2924.87-5.1 | 56.0.2924.87-5.1 | Feb 17, 2017 | A use after free in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2017-5018 | Med | 6.1 | < 56.0.2924.87-5.1 | 56.0.2924.87-5.1 | Feb 17, 2017 | Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, had an insufficiently strict content security policy on the Chrome app launcher page, which allowed a remote attacker to inject scripts or HTML into a privileged page via a crafted HTML | |
| CVE-2017-5017 | Med | 4.3 | < 56.0.2924.87-5.1 | 56.0.2924.87-5.1 | Feb 17, 2017 | Interactions with the OS in Google Chrome prior to 56.0.2924.76 for Mac insufficiently cleared video memory, which allowed a remote attacker to possibly extract image fragments on systems with GeForce 8600M graphics chips via a crafted HTML page. | |
| CVE-2017-5016 | Med | 6.5 | < 56.0.2924.87-5.1 | 56.0.2924.87-5.1 | Feb 17, 2017 | Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to prevent certain UI elements from being displayed by non-visible pages, which allowed a remote attacker to show certain UI elements on a page they don't control via a c | |
| CVE-2017-5015 | Med | 6.5 | < 56.0.2924.87-5.1 | 56.0.2924.87-5.1 | Feb 17, 2017 | Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled Unicode glyphs, which allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. | |
| CVE-2017-5014 | Med | 6.3 | < 56.0.2924.87-5.1 | 56.0.2924.87-5.1 | Feb 17, 2017 | Heap buffer overflow during image processing in Skia in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. | |
| CVE-2017-5013 | Med | 6.5 | < 56.0.2924.87-5.1 | 56.0.2924.87-5.1 | Feb 17, 2017 | Google Chrome prior to 56.0.2924.76 for Linux incorrectly handled new tab page navigations in non-selected tabs, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. | |
| CVE-2017-5012 | Hig | 8.8 | < 56.0.2924.87-5.1 | 56.0.2924.87-5.1 | Feb 17, 2017 | A heap buffer overflow in V8 in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2017-5011 | Med | 6.5 | < 56.0.2924.87-5.1 | 56.0.2924.87-5.1 | Feb 17, 2017 | Google Chrome prior to 56.0.2924.76 for Windows insufficiently sanitized DevTools URLs, which allowed a remote attacker who convinced a user to install a malicious extension to read filesystem contents via a crafted HTML page. | |
| CVE-2017-5010 | Med | 6.1 | < 56.0.2924.87-5.1 | 56.0.2924.87-5.1 | Feb 17, 2017 | Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, resolved promises in an inappropriate context, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. | |
| CVE-2017-5009 | Hig | 8.8 | < 56.0.2924.87-5.1 | 56.0.2924.87-5.1 | Feb 17, 2017 | WebRTC in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2017-5008 | Med | 6.1 | < 56.0.2924.87-5.1 | 56.0.2924.87-5.1 | Feb 17, 2017 | Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed attacker controlled JavaScript to be run during the invocation of a private script method, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via | |
| CVE-2017-5007 | Med | 6.1 | < 56.0.2924.87-5.1 | 56.0.2924.87-5.1 | Feb 17, 2017 | Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled the sequence of events when closing a page, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. | |
| CVE-2017-5006 | Med | 6.1 | < 56.0.2924.87-5.1 | 56.0.2924.87-5.1 | Feb 17, 2017 | Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled object owner relationships, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. | |
| CVE-2016-9650 | Med | 4.3 | < 55.0.2883.75-2.1 | 55.0.2883.75-2.1 | Jan 19, 2017 | Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled iframes, which allowed a remote attacker to bypass a no-referrer policy via a crafted HTML page. | |
| CVE-2016-5226 | Med | 6.1 | < 55.0.2883.75-2.1 | 55.0.2883.75-2.1 | Jan 19, 2017 | Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac executed javascript: URLs entered in the URL bar in the context of the current tab, which allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar. |
- affected < 56.0.2924.87-5.1fixed 56.0.2924.87-5.1
Type confusion in Histogram in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit a near null dereference via a crafted HTML page.
- affected < 56.0.2924.87-5.1fixed 56.0.2924.87-5.1
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to properly enforce unsafe-inline content security policy, which allowed a remote attacker to bypass content security policy via a crafted HTML page.
- affected < 56.0.2924.87-5.1fixed 56.0.2924.87-5.1
A use after free in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
- affected < 56.0.2924.87-5.1fixed 56.0.2924.87-5.1
Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to require a user gesture for powerful download operations, which allowed a remote attacker who convinced a user to install a malicious extension to execute arbitrary code via a c
- affected < 56.0.2924.87-5.1fixed 56.0.2924.87-5.1
A use after free in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- affected < 56.0.2924.87-5.1fixed 56.0.2924.87-5.1
Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, had an insufficiently strict content security policy on the Chrome app launcher page, which allowed a remote attacker to inject scripts or HTML into a privileged page via a crafted HTML
- affected < 56.0.2924.87-5.1fixed 56.0.2924.87-5.1
Interactions with the OS in Google Chrome prior to 56.0.2924.76 for Mac insufficiently cleared video memory, which allowed a remote attacker to possibly extract image fragments on systems with GeForce 8600M graphics chips via a crafted HTML page.
- affected < 56.0.2924.87-5.1fixed 56.0.2924.87-5.1
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to prevent certain UI elements from being displayed by non-visible pages, which allowed a remote attacker to show certain UI elements on a page they don't control via a c
- affected < 56.0.2924.87-5.1fixed 56.0.2924.87-5.1
Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled Unicode glyphs, which allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
- affected < 56.0.2924.87-5.1fixed 56.0.2924.87-5.1
Heap buffer overflow during image processing in Skia in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
- affected < 56.0.2924.87-5.1fixed 56.0.2924.87-5.1
Google Chrome prior to 56.0.2924.76 for Linux incorrectly handled new tab page navigations in non-selected tabs, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
- affected < 56.0.2924.87-5.1fixed 56.0.2924.87-5.1
A heap buffer overflow in V8 in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- affected < 56.0.2924.87-5.1fixed 56.0.2924.87-5.1
Google Chrome prior to 56.0.2924.76 for Windows insufficiently sanitized DevTools URLs, which allowed a remote attacker who convinced a user to install a malicious extension to read filesystem contents via a crafted HTML page.
- affected < 56.0.2924.87-5.1fixed 56.0.2924.87-5.1
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, resolved promises in an inappropriate context, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
- affected < 56.0.2924.87-5.1fixed 56.0.2924.87-5.1
WebRTC in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- affected < 56.0.2924.87-5.1fixed 56.0.2924.87-5.1
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed attacker controlled JavaScript to be run during the invocation of a private script method, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via
- affected < 56.0.2924.87-5.1fixed 56.0.2924.87-5.1
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled the sequence of events when closing a page, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
- affected < 56.0.2924.87-5.1fixed 56.0.2924.87-5.1
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled object owner relationships, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
- affected < 55.0.2883.75-2.1fixed 55.0.2883.75-2.1
Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled iframes, which allowed a remote attacker to bypass a no-referrer policy via a crafted HTML page.
- affected < 55.0.2883.75-2.1fixed 55.0.2883.75-2.1
Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac executed javascript: URLs entered in the URL bar in the context of the current tab, which allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar.
Page 16 of 18