rpm package
suse/chromium&distro=SUSE Package Hub 12 SP2
pkg:rpm/suse/chromium&distro=SUSE%20Package%20Hub%2012%20SP2
Vulnerabilities (343)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2018-17480 | — | KEV | < 71.0.3578.98-80.1 | 71.0.3578.98-80.1 | Dec 11, 2018 | Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. | |
| CVE-2018-6116 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | A nullptr dereference in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. | ||
| CVE-2018-6115 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | Inappropriate setting of the SEE_MASK_FLAG_NO_UI flag in file downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially bypass OS malware checks via a crafted HTML page. | ||
| CVE-2018-6108 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted HTML page. | ||
| CVE-2018-6107 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. | ||
| CVE-2018-6105 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. | ||
| CVE-2018-6104 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. | ||
| CVE-2018-6103 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | A stagnant permission prompt in Prompts in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass permission policy via a crafted HTML page. | ||
| CVE-2018-6102 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | Missing confusable characters in Internationalization in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. | ||
| CVE-2018-6101 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page, if the user is running a remote DevTools debugging server. | ||
| CVE-2018-6099 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | A lack of CORS checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page. | ||
| CVE-2018-6098 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. | ||
| CVE-2018-6095 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read local files via a crafted HTML page. | ||
| CVE-2018-6094 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | Inline metadata in GarbageCollection in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
| CVE-2018-6092 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. | ||
| CVE-2018-6090 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | An integer overflow that lead to a heap buffer-overflow in Skia in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. | ||
| CVE-2018-6089 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page. | ||
| CVE-2018-6088 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. | ||
| CVE-2018-6087 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. | ||
| CVE-2018-6086 | — | < 66.0.3359.181-55.1 | 66.0.3359.181-55.1 | Dec 4, 2018 | A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
- affected < 71.0.3578.98-80.1fixed 71.0.3578.98-80.1
Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2018-6116Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
A nullptr dereference in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
- CVE-2018-6115Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
Inappropriate setting of the SEE_MASK_FLAG_NO_UI flag in file downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially bypass OS malware checks via a crafted HTML page.
- CVE-2018-6108Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted HTML page.
- CVE-2018-6107Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
- CVE-2018-6105Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
- CVE-2018-6104Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
- CVE-2018-6103Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
A stagnant permission prompt in Prompts in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass permission policy via a crafted HTML page.
- CVE-2018-6102Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
Missing confusable characters in Internationalization in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
- CVE-2018-6101Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page, if the user is running a remote DevTools debugging server.
- CVE-2018-6099Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
A lack of CORS checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page.
- CVE-2018-6098Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
- CVE-2018-6095Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read local files via a crafted HTML page.
- CVE-2018-6094Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
Inline metadata in GarbageCollection in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2018-6092Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2018-6090Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
An integer overflow that lead to a heap buffer-overflow in Skia in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2018-6089Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page.
- CVE-2018-6088Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.
- CVE-2018-6087Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2018-6086Dec 4, 2018affected < 66.0.3359.181-55.1fixed 66.0.3359.181-55.1
A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
Page 5 of 18