Search for packages
| purl | pkg:deb/ubuntu/oxide-qt@1.15.7-0ubuntu1 |
| Next non-vulnerable version | 1.21.5-0ubuntu0.14.04.1 |
| Latest non-vulnerable version | 1.21.5-0ubuntu0.16.04.1 |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-15et-tcvg-aaab
Aliases: CVE-2016-5199 |
An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted video file. |
Affected by 45 other vulnerabilities. Affected by 45 other vulnerabilities. |
|
VCID-18sf-2pc8-aaah
Aliases: CVE-2016-5142 |
The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code, related to NormalizeAlgorithm.cpp and SubtleCrypto.cpp. |
Affected by 67 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-37qj-e7y3-aaab
Aliases: CVE-2016-5213 |
A use after free in V8 in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-3dw3-1sjv-aaag
Aliases: CVE-2016-5202 |
browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux neglects to copy a device ID before an erase() call, which causes the erase operation to access data that that erase operation will destroy. |
Affected by 45 other vulnerabilities. Affected by 45 other vulnerabilities. |
|
VCID-3fxs-63ze-aaam
Aliases: CVE-2017-5030 |
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-3qy7-nend-aaac
Aliases: CVE-2016-5164 |
Cross-site scripting (XSS) vulnerability in WebKit/Source/platform/v8_inspector/V8Debugger.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML into the Developer Tools (aka DevTools) subsystem via a crafted web site, aka "Universal XSS (UXSS)." |
Affected by 67 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-3ssp-uvwm-aaab
Aliases: CVE-2016-5186 |
Devtools in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled objects after a tab crash, which allowed a remote attacker to perform an out of bounds memory read via crafted PDF files. |
Affected by 49 other vulnerabilities. Affected by 49 other vulnerabilities. |
|
VCID-561u-gsq3-aaab
Aliases: CVE-2016-9651 |
A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-5hhe-zms4-aaar
Aliases: CVE-2016-5145 |
Blink, as used in Google Chrome before 52.0.2743.116, does not ensure that a taint property is preserved after a structure-clone operation on an ImageBitmap object derived from a cross-origin image, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code. |
Affected by 67 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-63em-f5aj-aaad
Aliases: CVE-2017-5040 |
V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android was missing a neutering check, which allowed a remote attacker to read values in memory via a crafted HTML page. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-665s-e3x3-aaaj
Aliases: CVE-2016-5156 |
extensions/renderer/event_bindings.cc in the event bindings in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux attempts to process filtered events after failure to add an event matcher, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors. |
Affected by 67 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-8999-y7he-aaab
Aliases: CVE-2016-5219 |
A heap use after free in V8 in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-8q7a-nwqd-aaan
Aliases: CVE-2016-5148 |
Cross-site scripting (XSS) vulnerability in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML via vectors related to widget updates, aka "Universal XSS (UXSS)." |
Affected by 67 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-8wa2-7dk5-aaan
Aliases: CVE-2016-5161 |
The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles custom properties, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site that leverages "type confusion" in the StylePropertySerializer class. |
Affected by 67 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-9m93-udyb-aaak
Aliases: CVE-2016-5175 |
Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.113 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. |
Affected by 59 other vulnerabilities. Affected by 59 other vulnerabilities. |
|
VCID-9r59-cy8b-aaaa
Aliases: CVE-2017-5006 |
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled object owner relationships, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-9tv6-tvj9-aaah
Aliases: CVE-2017-5017 |
Interactions with the OS in Google Chrome prior to 56.0.2924.76 for Mac insufficiently cleared video memory, which allowed a remote attacker to possibly extract image fragments on systems with GeForce 8600M graphics chips via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-9wkw-j45r-aaar
Aliases: CVE-2017-5022 |
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to properly enforce unsafe-inline content security policy, which allowed a remote attacker to bypass content security policy via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-9y6t-uz46-aaad
Aliases: CVE-2017-5029 GHSA-pf6m-fxpq-fg8v |
The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-a267-g4j5-aaab
Aliases: CVE-2016-5132 |
The Service Workers subsystem in Google Chrome before 52.0.2743.82 does not properly implement the Secure Contexts specification during decisions about whether to control a subframe, which allows remote attackers to bypass the Same Origin Policy via an https IFRAME element inside an http IFRAME element. |
Affected by 84 other vulnerabilities. Affected by 84 other vulnerabilities. |
|
VCID-a968-v7d1-aaah
Aliases: CVE-2017-5035 |
Google Chrome prior to 57.0.2987.98 for Windows and Mac had a race condition, which could cause Chrome to display incorrect certificate information for a site. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-axrj-ax7a-aaam
Aliases: CVE-2016-1704 |
Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.103 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. |
Affected by 98 other vulnerabilities. Affected by 98 other vulnerabilities. |
|
VCID-aymf-9rhk-aaag
Aliases: CVE-2016-5170 |
WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google Chrome before 53.0.2785.113, does not properly consider getter side effects during array key conversion, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted Indexed Database (aka IndexedDB) API calls. |
Affected by 59 other vulnerabilities. Affected by 59 other vulnerabilities. |
|
VCID-b4ay-xbyg-aaaa
Aliases: CVE-2017-5024 |
FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted video file. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-b6gm-xpgj-aaag
Aliases: CVE-2017-5025 |
FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted video file. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-brb9-3xj9-aaah
Aliases: CVE-2017-5014 |
Heap buffer overflow during image processing in Skia in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-bzx2-njp3-aaac
Aliases: CVE-2017-5010 |
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, resolved promises in an inappropriate context, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-c5t4-3azw-aaah
Aliases: CVE-2016-9652 |
Multiple unspecified vulnerabilities in Google Chrome before 55.0.2883.75. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-cjt2-72uw-aaaf
Aliases: CVE-2016-5207 |
In Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android, corruption of the DOM tree could occur during the removal of a full screen element, which allowed a remote attacker to achieve arbitrary code execution via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-cmsz-uwmb-aaak
Aliases: CVE-2016-5198 |
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code execution, via a crafted HTML page. |
Affected by 45 other vulnerabilities. Affected by 45 other vulnerabilities. |
|
VCID-cqu7-s836-aaaq
Aliases: CVE-2016-5153 |
The Web Animations implementation in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, improperly relies on list iteration, which allows remote attackers to cause a denial of service (use-after-destruction) or possibly have unspecified other impact via a crafted web site. |
Affected by 67 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-dc82-nm96-aaac
Aliases: CVE-2017-5031 |
A use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-dp4q-cu85-aaam
Aliases: CVE-2016-5178 |
Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.143 allow remote attackers to cause a denial of service or possibly have other impact via unknown vectors. |
Affected by 59 other vulnerabilities. Affected by 59 other vulnerabilities. |
|
VCID-dspz-cq4b-aaah
Aliases: CVE-2016-5181 |
Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted execution of v8 microtasks while the DOM was in an inconsistent state, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages. |
Affected by 49 other vulnerabilities. Affected by 49 other vulnerabilities. |
|
VCID-e5sn-g1vc-aaan
Aliases: CVE-2017-5041 |
Google Chrome prior to 57.0.2987.100 incorrectly handled back-forward navigation, which allowed a remote attacker to display incorrect information for a site via a crafted HTML page. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-ec8c-js3n-aaap
Aliases: CVE-2016-1705 |
Multiple unspecified vulnerabilities in Google Chrome before 52.0.2743.82 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. |
Affected by 84 other vulnerabilities. Affected by 84 other vulnerabilities. |
|
VCID-eg6q-kekn-aaas
Aliases: CVE-2015-3395 |
The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-erag-eyn2-aaah
Aliases: CVE-2016-9650 |
Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled iframes, which allowed a remote attacker to bypass a no-referrer policy via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-ewf2-44r6-aaag
Aliases: CVE-2016-5188 |
Multiple issues in Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux allow a remote attacker to spoof various parts of browser UI via crafted HTML pages. |
Affected by 49 other vulnerabilities. Affected by 49 other vulnerabilities. |
|
VCID-f4xe-nj5v-aaae
Aliases: CVE-2016-5171 |
WebKit/Source/bindings/templates/interface.cpp in Blink, as used in Google Chrome before 53.0.2785.113, does not prevent certain constructor calls, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code. |
Affected by 59 other vulnerabilities. Affected by 59 other vulnerabilities. |
|
VCID-f6fe-jwwu-aaaa
Aliases: CVE-2016-5194 |
Unspecified vulnerabilities in Google Chrome before 54.0.2840.59. |
Affected by 49 other vulnerabilities. Affected by 49 other vulnerabilities. |
|
VCID-f84k-swdb-aaan
Aliases: CVE-2016-5209 |
Bad casting in bitmap manipulation in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-fp9y-jfya-aaaj
Aliases: CVE-2016-5128 |
objects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not prevent API interceptors from modifying a store target without setting a property, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. |
Affected by 84 other vulnerabilities. Affected by 84 other vulnerabilities. |
|
VCID-fzdj-kjcc-aaak
Aliases: CVE-2016-7549 |
Google Chrome before 53.0.2785.113 does not ensure that the recipient of a certain IPC message is a valid RenderFrame or RenderWidget, which allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) or possibly have unspecified other impact by leveraging access to a renderer process, related to render_frame_host_impl.cc and render_widget_host_impl.cc, as demonstrated by a Password Manager message. |
Affected by 59 other vulnerabilities. Affected by 59 other vulnerabilities. |
|
VCID-ggky-nw5w-aaar
Aliases: CVE-2016-5185 |
Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly allowed reentrance of FrameView::updateLifecyclePhasesInternal(), which allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages. |
Affected by 49 other vulnerabilities. Affected by 49 other vulnerabilities. |
|
VCID-gkum-epbx-aaaq
Aliases: CVE-2017-5046 |
V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android had insufficient policy enforcement, which allowed a remote attacker to spoof the location object via a crafted HTML page, related to Blink information disclosure. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-hvsv-htj9-aaap
Aliases: CVE-2016-5167 |
Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors. |
Affected by 67 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-kc87-8y6z-aaaq
Aliases: CVE-2016-5187 |
Google Chrome prior to 54.0.2840.85 for Android incorrectly handled rapid transition into and out of full screen mode, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages. |
Affected by 49 other vulnerabilities. Affected by 49 other vulnerabilities. |
|
VCID-khbk-ubvw-aaaq
Aliases: CVE-2016-5146 |
Multiple unspecified vulnerabilities in Google Chrome before 52.0.2743.116 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. |
Affected by 67 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-kj1j-du4f-aaac
Aliases: CVE-2016-5129 |
Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objects, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code. |
Affected by 84 other vulnerabilities. Affected by 84 other vulnerabilities. |
|
VCID-kp5n-qnpm-aaaq
Aliases: CVE-2016-5221 |
Type confusion in libGLESv2 in ANGLE in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android possibly allowed a remote attacker to bypass buffer validation via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-m24c-e83m-aaah
Aliases: CVE-2016-5130 |
content/renderer/history_controller.cc in Google Chrome before 52.0.2743.82 does not properly restrict multiple uses of a JavaScript forward method, which allows remote attackers to spoof the URL display via a crafted web site. |
Affected by 84 other vulnerabilities. Affected by 84 other vulnerabilities. |
|
VCID-m7pt-esj7-aaaf
Aliases: CVE-2016-7395 |
SkPath.cpp in Skia, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, does not properly validate the return values of ChopMonoAtY calls, which allows remote attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via crafted graphics data. |
Affected by 67 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-mewv-var3-aaar
Aliases: CVE-2016-5165 |
Cross-site scripting (XSS) vulnerability in the Developer Tools (aka DevTools) subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allows remote attackers to inject arbitrary web script or HTML via the settings parameter in a chrome-devtools-frontend.appspot.com URL's query string. |
Affected by 67 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-mjtj-t247-aaah
Aliases: CVE-2016-5133 |
Google Chrome before 52.0.2743.82 mishandles origin information during proxy authentication, which allows man-in-the-middle attackers to spoof a proxy-authentication login prompt or trigger incorrect credential storage by modifying the client-server data stream. |
Affected by 84 other vulnerabilities. Affected by 84 other vulnerabilities. |
|
VCID-mr8h-b2uz-aaab
Aliases: CVE-2016-5204 |
Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-mt8f-pyvq-aaaq
Aliases: CVE-2017-5009 |
WebRTC in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-n2f3-tvmz-aaak
Aliases: CVE-2016-5192 |
Blink in Google Chrome prior to 54.0.2840.59 for Windows missed a CORS check on redirect in TextTrackLoader, which allowed a remote attacker to bypass cross-origin restrictions via crafted HTML pages. |
Affected by 49 other vulnerabilities. Affected by 49 other vulnerabilities. |
|
VCID-n9pt-7u7g-aaab
Aliases: CVE-2016-5134 |
net/proxy/proxy_service.cc in the Proxy Auto-Config (PAC) feature in Google Chrome before 52.0.2743.82 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, a related issue to CVE-2016-3763. |
Affected by 84 other vulnerabilities. Affected by 84 other vulnerabilities. |
|
VCID-nevx-9gyg-aaad
Aliases: CVE-2016-5215 |
A use after free in webaudio in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-nhhe-457p-aaaf
Aliases: CVE-2016-1710 |
The ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not prevent window creation by a deferred frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. |
Affected by 84 other vulnerabilities. Affected by 84 other vulnerabilities. |
|
VCID-nkf5-xx9k-aaah
Aliases: CVE-2016-5200 |
V8 in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android incorrectly applied type rules, which allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 45 other vulnerabilities. Affected by 45 other vulnerabilities. |
|
VCID-p817-jw6u-aaas
Aliases: CVE-2016-5224 |
A timing attack on denormalized floating point arithmetic in SVG filters in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-pe2a-7rtn-aaaq
Aliases: CVE-2017-5019 |
A use after free in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-pf6b-dxvk-aaan
Aliases: CVE-2016-5131 |
Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function. |
Affected by 84 other vulnerabilities. Affected by 84 other vulnerabilities. |
|
VCID-q8bh-zcj7-aaaq
Aliases: CVE-2016-5172 |
The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code. |
Affected by 59 other vulnerabilities. Affected by 59 other vulnerabilities. |
|
VCID-qgjz-nen9-aaan
Aliases: CVE-2016-5225 |
Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled form actions, which allowed a remote attacker to bypass Content Security Policy via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-qthf-xyzg-aaan
Aliases: CVE-2016-5147 |
Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles deferred page loads, which allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)." |
Affected by 67 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-rbbx-p6kq-aaas
Aliases: CVE-2016-5177 |
Use-after-free vulnerability in V8 in Google Chrome before 53.0.2785.143 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via unknown vectors. |
Affected by 59 other vulnerabilities. Affected by 59 other vulnerabilities. |
|
VCID-rkcb-qyc8-aaaa
Aliases: CVE-2017-5045 |
XSS Auditor in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed detection of a blocked iframe load, which allowed a remote attacker to brute force JavaScript variables via a crafted HTML page. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-s5ta-1p4j-aaad
Aliases: CVE-2016-5212 |
Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android insufficiently sanitized DevTools URLs, which allowed a remote attacker to read local files via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-s7zr-aw7h-aaan
Aliases: CVE-2017-5044 |
Heap buffer overflow in filter processing in Skia in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-sgnc-347g-aaah
Aliases: CVE-2017-5023 |
Type confusion in Histogram in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit a near null dereference via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-snp1-1vxd-aaaa
Aliases: CVE-2016-1586 |
A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in versions of Oxide before 1.18.3. |
Affected by 49 other vulnerabilities. Affected by 49 other vulnerabilities. |
|
VCID-spvv-jn57-aaam
Aliases: CVE-2016-5205 |
Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac, incorrectly handles deferred page loads, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-syhs-jdj3-aaas
Aliases: CVE-2017-5008 |
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed attacker controlled JavaScript to be run during the invocation of a private script method, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-t42a-hd1c-aaaa
Aliases: CVE-2016-5222 |
Incorrect handling of invalid URLs in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-t7v2-yu54-aaaa
Aliases: CVE-2014-9911 |
Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call. |
Affected by 59 other vulnerabilities. Affected by 59 other vulnerabilities. |
|
VCID-t8gt-2hus-aaaa
Aliases: CVE-2017-5037 |
An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-tpeh-7gcc-aaaf
Aliases: CVE-2017-5026 |
Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to prevent alerts from being displayed by swapped out frames, which allowed a remote attacker to show alerts on a page they don't control via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-tpn3-2brd-aaad
Aliases: CVE-2017-5033 |
Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page, related to the unsafe-inline keyword. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-tznb-pcuf-aaar
Aliases: CVE-2016-5226 |
Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac executed javascript: URLs entered in the URL bar in the context of the current tab, which allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-ucbt-trvs-aaam
Aliases: CVE-2016-1711 |
WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not disable frame navigation during a detach operation on a DocumentLoader object, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. |
Affected by 84 other vulnerabilities. Affected by 84 other vulnerabilities. |
|
VCID-ufg7-d65p-aaak
Aliases: CVE-2017-5027 |
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to properly enforce unsafe-inline content security policy, which allowed a remote attacker to bypass content security policy via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-ukmv-wdhg-aaae
Aliases: CVE-2016-5137 |
The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 52.0.2743.82, does not apply http :80 policies to https :443 URLs and does not apply ws :80 policies to wss :443 URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report. NOTE: this vulnerability is associated with a specification change after CVE-2016-1617 resolution. |
Affected by 84 other vulnerabilities. Affected by 84 other vulnerabilities. |
|
VCID-uskx-td9k-aaak
Aliases: CVE-2016-5127 |
Use-after-free vulnerability in WebKit/Source/core/editing/VisibleUnits.cpp in Blink, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code involving an @import at-rule in a Cascading Style Sheets (CSS) token sequence in conjunction with a rel=import attribute of a LINK element. |
Affected by 84 other vulnerabilities. Affected by 84 other vulnerabilities. |
|
VCID-vd5v-psbw-aaaq
Aliases: CVE-2016-5208 |
Blink in Google Chrome prior to 55.0.2883.75 for Linux and Windows, and 55.0.2883.84 for Android allowed possible corruption of the DOM tree during synchronous event handling, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-w8pm-ggck-aaar
Aliases: CVE-2016-5144 |
The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different vulnerability than CVE-2016-5143. |
Affected by 67 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-wbn4-ykqu-aaak
Aliases: CVE-2017-5007 |
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled the sequence of events when closing a page, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-wdpa-yxc1-aaaa
Aliases: CVE-2017-5012 |
A heap buffer overflow in V8 in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-wuby-sjvn-aaah
Aliases: CVE-2016-5182 |
Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation in bitmap handling, which allowed a remote attacker to potentially exploit heap corruption via crafted HTML pages. |
Affected by 49 other vulnerabilities. Affected by 49 other vulnerabilities. |
|
VCID-x628-g9qg-aaam
Aliases: CVE-2016-5189 |
Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted navigation to blob URLs with non-canonical origins, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages. |
Affected by 49 other vulnerabilities. Affected by 49 other vulnerabilities. |
|
VCID-xac2-xgfb-aaac
Aliases: CVE-2016-5155 |
Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly validate access to the initial document, which allows remote attackers to spoof the address bar via a crafted web site. |
Affected by 67 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-xpyj-uw54-aaam
Aliases: CVE-2017-5011 |
Google Chrome prior to 56.0.2924.76 for Windows insufficiently sanitized DevTools URLs, which allowed a remote attacker who convinced a user to install a malicious extension to read filesystem contents via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-yehd-sm9z-aaad
Aliases: CVE-2016-5150 |
WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, has an Indexed Database (aka IndexedDB) API implementation that does not properly restrict key-path evaluation, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code that leverages certain side effects. |
Affected by 67 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-ytxf-t2w9-aaaj
Aliases: CVE-2016-5141 |
Blink, as used in Google Chrome before 52.0.2743.116, allows remote attackers to spoof the address bar via vectors involving a provisional URL for an initially empty document, related to FrameLoader.cpp and ScopedPageLoadDeferrer.cpp. |
Affected by 67 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-zhrf-jjwp-aaas
Aliases: CVE-2016-1706 |
The PPAPI implementation in Google Chrome before 52.0.2743.82 does not validate the origin of IPC messages to the plugin broker process that should have come from the browser process, which allows remote attackers to bypass a sandbox protection mechanism via an unexpected message type, related to broker_process_dispatcher.cc, ppapi_plugin_process_host.cc, ppapi_thread.cc, and render_frame_message_filter.cc. |
Affected by 84 other vulnerabilities. Affected by 84 other vulnerabilities. |
|
VCID-zm2t-crgn-aaaq
Aliases: CVE-2016-5135 |
WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not consider referrer-policy information inside an HTML document during a preload request, which allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a crafted web site, as demonstrated by a "Content-Security-Policy: referrer origin-when-cross-origin" header that overrides a "<META name='referrer' content='no-referrer'>" element. |
Affected by 84 other vulnerabilities. Affected by 84 other vulnerabilities. |
|
VCID-zvhz-paa8-aaah
Aliases: CVE-2016-5143 |
The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different vulnerability than CVE-2016-5144. |
Affected by 67 other vulnerabilities. Affected by 67 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|