suse/chromium&distro=SUSE Package Hub 12

Vulnerabilities (132)

• CVE-2016-5174MedSep 25, 2016
  affected < 53.0.2785.113-100.1fixed 53.0.2785.113-100.1

  browser/ui/cocoa/browser_window_controller_private.mm in Google Chrome before 53.0.2785.113 does not process fullscreen toggle requests during a fullscreen transition, which allows remote attackers to cause a denial of service (unsuppressed popup) via a crafted web site.

• CVE-2016-5173HigSep 25, 2016
  affected < 53.0.2785.113-100.1fixed 53.0.2785.113-100.1

  The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote attackers to load unintended resources, and consequently trigger unintended JavaScript function calls and bypass the Same Origin Policy via an

• CVE-2016-5172MedSep 25, 2016
  affected < 53.0.2785.113-100.1fixed 53.0.2785.113-100.1

  The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code.

• CVE-2016-5171HigSep 25, 2016
  affected < 53.0.2785.113-100.1fixed 53.0.2785.113-100.1

  WebKit/Source/bindings/templates/interface.cpp in Blink, as used in Google Chrome before 53.0.2785.113, does not prevent certain constructor calls, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted Ja

• CVE-2016-5170HigSep 25, 2016
  affected < 53.0.2785.113-100.1fixed 53.0.2785.113-100.1

  WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google Chrome before 53.0.2785.113, does not properly consider getter side effects during array key conversion, which allows remote attackers to cause a denial of service (use-after-free) or possibly h

• CVE-2016-5166LowSep 11, 2016
  affected < 53.0.2785.89-96.1fixed 53.0.2785.89-96.1

  The download implementation in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly restrict saving a file:// URL that is referenced by an http:// URL, which makes it easier for user-assisted remote attackers to discover NetNTLM

• CVE-2016-5165MedSep 11, 2016
  affected < 53.0.2785.89-96.1fixed 53.0.2785.89-96.1

  Cross-site scripting (XSS) vulnerability in the Developer Tools (aka DevTools) subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allows remote attackers to inject arbitrary web script or HTML via the settings parameter in a chrome

• CVE-2016-5164MedSep 11, 2016
  affected < 53.0.2785.89-96.1fixed 53.0.2785.89-96.1

  Cross-site scripting (XSS) vulnerability in WebKit/Source/platform/v8_inspector/V8Debugger.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML into the Deve

• CVE-2016-5163MedSep 11, 2016
  affected < 53.0.2785.89-96.1fixed 53.0.2785.89-96.1

  The bidirectional-text implementation in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not ensure left-to-right (LTR) rendering of URLs, which allows remote attackers to spoof the address bar via crafted right-to-left (RTL) Unicode te

• CVE-2016-5162MedSep 11, 2016
  affected < 53.0.2785.89-96.1fixed 53.0.2785.89-96.1

  The AllowCrossRendererResourceLoad function in extensions/browser/url_request_util.cc in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly use an extension's manifest.json web_accessible_resources field for restrictions on IF

• CVE-2016-5161HigSep 11, 2016
  affected < 53.0.2785.89-96.1fixed 53.0.2785.89-96.1

  The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles custom properties, which allows remote attackers to cause a denial of servi

• CVE-2016-5160MedSep 11, 2016
  affected < 53.0.2785.89-96.1fixed 53.0.2785.89-96.1

  The AllowCrossRendererResourceLoad function in extensions/browser/url_request_util.cc in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly use an extension's manifest.json web_accessible_resources field for restrictions on IF

• CVE-2016-5159HigSep 11, 2016
  affected < 53.0.2785.89-96.1fixed 53.0.2785.89-96.1

  Multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via craf

• CVE-2016-5158HigSep 11, 2016
  affected < 53.0.2785.89-96.1fixed 53.0.2785.89-96.1

  Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or poss

• CVE-2016-5157HigSep 11, 2016
  affected < 53.0.2785.89-96.1fixed 53.0.2785.89-96.1

  Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to execute arbitrary code via crafted coordinate values in JP

• CVE-2016-5156HigSep 11, 2016
  affected < 53.0.2785.89-96.1fixed 53.0.2785.89-96.1

  extensions/renderer/event_bindings.cc in the event bindings in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux attempts to process filtered events after failure to add an event matcher, which allows remote attackers to cause a denial of serv

• CVE-2016-5155MedSep 11, 2016
  affected < 53.0.2785.89-96.1fixed 53.0.2785.89-96.1

  Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly validate access to the initial document, which allows remote attackers to spoof the address bar via a crafted web site.

• CVE-2016-5154HigSep 11, 2016
  affected < 53.0.2785.89-96.1fixed 53.0.2785.89-96.1

  Multiple heap-based buffer overflows in PDFium, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JBig2 image.

• CVE-2016-5153HigSep 11, 2016
  affected < 53.0.2785.89-96.1fixed 53.0.2785.89-96.1

  The Web Animations implementation in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, improperly relies on list iteration, which allows remote attackers to cause a denial of service (use-after-destruction) or possibly have

• CVE-2016-5152HigSep 11, 2016
  affected < 53.0.2785.89-96.1fixed 53.0.2785.89-96.1

  Integer overflow in the opj_tcd_get_decoded_tile_size function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to cause a denial of service (heap-based buffer overflow) or p