Lucene search

K

OpenSUSE Security Vulnerabilities

cve
cve

CVE-2016-1696

The extensions subsystem in Google Chrome before 51.0.2704.79 does not properly restrict bindings access, which allows remote attackers to bypass the Same Origin Policy via unspecified...

8.8CVSS

8.2AI Score

0.016EPSS

2016-06-05 11:59 PM
45
cve
cve

CVE-2016-1695

Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.63 allow attackers to cause a denial of service or possibly have other impact via unknown...

8.8CVSS

8.7AI Score

0.007EPSS

2016-06-05 11:59 PM
40
cve
cve

CVE-2016-1694

browser/browsing_data/browsing_data_remover.cc in Google Chrome before 51.0.2704.63 deletes HPKP pins during cache clearing, which makes it easier for remote attackers to spoof web sites via a valid certificate from an arbitrary recognized Certification...

5.3CVSS

6AI Score

0.004EPSS

2016-06-05 11:59 PM
40
cve
cve

CVE-2016-1693

browser/safe_browsing/srt_field_trial_win.cc in Google Chrome before 51.0.2704.63 does not use the HTTPS service on dl.google.com to obtain the Software Removal Tool, which allows remote attackers to spoof the chrome_cleanup_tool.exe (aka CCT) file via a man-in-the-middle attack on an HTTP...

5.3CVSS

5.8AI Score

0.002EPSS

2016-06-05 11:59 PM
37
cve
cve

CVE-2016-1692

WebKit/Source/core/css/StyleSheetContents.cpp in Blink, as used in Google Chrome before 51.0.2704.63, permits cross-origin loading of CSS stylesheets by a ServiceWorker even when the stylesheet download has an incorrect MIME type, which allows remote attackers to bypass the Same Origin Policy via.....

5.3CVSS

5.9AI Score

0.004EPSS

2016-06-05 11:59 PM
37
cve
cve

CVE-2016-1691

Skia, as used in Google Chrome before 51.0.2704.63, mishandles coincidence runs, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted curves, related to SkOpCoincidence.cpp and...

7.5CVSS

8.2AI Score

0.018EPSS

2016-06-05 11:59 PM
52
cve
cve

CVE-2016-1690

The Autofill implementation in Google Chrome before 51.0.2704.63 mishandles the interaction between field updates and JavaScript code that triggers a frame deletion, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted.....

7.5CVSS

8.1AI Score

0.01EPSS

2016-06-05 11:59 PM
41
cve
cve

CVE-2016-1689

Heap-based buffer overflow in content/renderer/media/canvas_capture_handler.cc in Google Chrome before 51.0.2704.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web...

6.5CVSS

7.6AI Score

0.01EPSS

2016-06-05 11:59 PM
46
cve
cve

CVE-2016-1688

The regexp (aka regular expression) implementation in Google V8 before 5.0.71.40, as used in Google Chrome before 51.0.2704.63, mishandles external string sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted JavaScript...

6.5CVSS

6.6AI Score

0.025EPSS

2016-06-05 11:59 PM
44
cve
cve

CVE-2016-1687

The renderer implementation in Google Chrome before 51.0.2704.63 does not properly restrict public exposure of classes, which allows remote attackers to obtain sensitive information via vectors related to...

6.5CVSS

6.5AI Score

0.006EPSS

2016-06-05 11:59 PM
44
cve
cve

CVE-2016-1686

The CPDF_DIBSource::CreateDecoder function in core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp in PDFium, as used in Google Chrome before 51.0.2704.63, mishandles decoder-initialization failure, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF...

6.5CVSS

6.5AI Score

0.023EPSS

2016-06-05 11:59 PM
37
cve
cve

CVE-2016-1685

core/fxge/ge/fx_ge_text.cpp in PDFium, as used in Google Chrome before 51.0.2704.63, miscalculates certain index values, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF...

6.5CVSS

6.5AI Score

0.023EPSS

2016-06-05 11:59 PM
39
cve
cve

CVE-2016-1683

numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles namespace nodes, which allows remote attackers to cause a denial of service (out-of-bounds heap memory access) or possibly have unspecified other impact via a crafted...

7.5CVSS

8.1AI Score

0.048EPSS

2016-06-05 11:59 PM
67
cve
cve

CVE-2016-1682

The ServiceWorkerContainer::registerServiceWorkerImpl function in WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.cpp in Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a ServiceWorker...

6.1CVSS

6.6AI Score

0.004EPSS

2016-06-05 11:59 PM
45
cve
cve

CVE-2016-1681

Heap-based buffer overflow in the opj_j2k_read_SPCod_SPCoc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 51.0.2704.63, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF...

8.8CVSS

8.9AI Score

0.017EPSS

2016-06-05 11:59 PM
48
cve
cve

CVE-2016-1680

Use-after-free vulnerability in ports/SkFontHost_FreeType.cpp in Skia, as used in Google Chrome before 51.0.2704.63, allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via unknown...

8.8CVSS

8.7AI Score

0.023EPSS

2016-06-05 11:59 PM
48
cve
cve

CVE-2016-1679

The ToV8Value function in content/child/v8_value_converter_impl.cc in the V8 bindings in Google Chrome before 51.0.2704.63 does not properly restrict use of getters and setters, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact...

8.8CVSS

8.8AI Score

0.023EPSS

2016-06-05 11:59 PM
36
cve
cve

CVE-2016-1678

objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JavaScript...

8.8CVSS

8.8AI Score

0.019EPSS

2016-06-05 11:59 PM
44
cve
cve

CVE-2016-1677

uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain sensitive information by calling the decodeURI function and leveraging "type...

6.5CVSS

6.7AI Score

0.006EPSS

2016-06-05 11:59 PM
45
cve
cve

CVE-2016-1676

extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.63 does not properly use prototypes, which allows remote attackers to bypass the Same Origin Policy via unspecified...

8.8CVSS

8.2AI Score

0.015EPSS

2016-06-05 11:59 PM
47
2
cve
cve

CVE-2016-1675

Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy by leveraging the mishandling of Document reattachment during destruction, related to FrameLoader.cpp and...

8.8CVSS

8.2AI Score

0.016EPSS

2016-06-05 11:59 PM
39
cve
cve

CVE-2016-1674

The extensions subsystem in Google Chrome before 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified...

8.8CVSS

8.2AI Score

0.013EPSS

2016-06-05 11:59 PM
39
cve
cve

CVE-2016-1673

Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy via unspecified...

8.8CVSS

8.2AI Score

0.013EPSS

2016-06-05 11:59 PM
34
cve
cve

CVE-2016-1672

The ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the extension bindings in Google Chrome before 51.0.2704.63 mishandles properties, which allows remote attackers to conduct bindings-interception attacks and bypass the Same Origin Policy via unspecified...

8.8CVSS

8.2AI Score

0.015EPSS

2016-06-05 11:59 PM
42
cve
cve

CVE-2016-4804

The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat...

6.2CVSS

6.2AI Score

0.002EPSS

2016-06-03 02:59 PM
47
cve
cve

CVE-2015-8872

The set_fat function in fat.c in dosfstools before 4.0 might allow attackers to corrupt a FAT12 filesystem or cause a denial of service (invalid memory read and crash) by writing an odd number of clusters to the third to last entry on a FAT12 filesystem, which triggers an "off-by-two...

6.2CVSS

6.1AI Score

0.002EPSS

2016-06-03 02:59 PM
47
cve
cve

CVE-2016-3697

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a...

7.8CVSS

7.4AI Score

0.0004EPSS

2016-06-01 08:59 PM
40
cve
cve

CVE-2016-3075

Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long...

7.5CVSS

7.2AI Score

0.01EPSS

2016-06-01 08:59 PM
99
cve
cve

CVE-2016-1234

Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attackers to cause a denial of service (crash) via a long...

7.5CVSS

7.2AI Score

0.002EPSS

2016-06-01 08:59 PM
88
cve
cve

CVE-2016-0718

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer...

9.8CVSS

8.7AI Score

0.008EPSS

2016-05-26 04:59 PM
265
8
cve
cve

CVE-2016-4049

The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP...

7.5CVSS

7.2AI Score

0.026EPSS

2016-05-23 07:59 PM
39
cve
cve

CVE-2016-4805

Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in the Linux kernel before 4.5.2 allows local users to cause a denial of service (memory corruption and system crash, or spinlock) or possibly have unspecified other impact by removing a network namespace, related to the...

7.8CVSS

7.7AI Score

0.0004EPSS

2016-05-23 10:59 AM
105
cve
cve

CVE-2016-4578

sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2)...

5.5CVSS

5.9AI Score

0.0004EPSS

2016-05-23 10:59 AM
148
2
cve
cve

CVE-2016-4544

The exif_process_TIFF_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate TIFF start data, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header.....

9.8CVSS

7.8AI Score

0.014EPSS

2016-05-22 01:59 AM
130
2
cve
cve

CVE-2016-4346

Integer overflow in the str_pad function in ext/standard/string.c in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long string, leading to a heap-based buffer...

9.8CVSS

9.9AI Score

0.007EPSS

2016-05-22 01:59 AM
67
4
cve
cve

CVE-2016-4343

The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR...

8.8CVSS

7AI Score

0.291EPSS

2016-05-22 01:59 AM
102
4
cve
cve

CVE-2015-8866

ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted...

9.6CVSS

7AI Score

0.079EPSS

2016-05-22 01:59 AM
75
3
cve
cve

CVE-2016-4348

The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via circular definitions in an SVG...

7.5CVSS

7.1AI Score

0.009EPSS

2016-05-20 02:59 PM
40
cve
cve

CVE-2016-1670

Race condition in the ResourceDispatcherHostImpl::BeginRequest function in content/browser/loader/resource_dispatcher_host_impl.cc in Google Chrome before 50.0.2661.102 allows remote attackers to make arbitrary HTTP requests by leveraging access to a renderer process and reusing a request...

5.3CVSS

6.2AI Score

0.004EPSS

2016-05-14 09:59 PM
50
cve
cve

CVE-2016-1669

The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other...

8.8CVSS

8.8AI Score

0.035EPSS

2016-05-14 09:59 PM
60
4
cve
cve

CVE-2016-1668

The forEachForBinding function in WebKit/Source/bindings/core/v8/Iterable.h in the V8 bindings in Blink, as used in Google Chrome before 50.0.2661.102, uses an improper creation context, which allows remote attackers to bypass the Same Origin Policy via a crafted web...

8.8CVSS

8AI Score

0.009EPSS

2016-05-14 09:59 PM
46
cve
cve

CVE-2016-1667

The TreeScope::adoptIfNeeded function in WebKit/Source/core/dom/TreeScope.cpp in the DOM implementation in Blink, as used in Google Chrome before 50.0.2661.102, does not prevent script execution during node-adoption operations, which allows remote attackers to bypass the Same Origin Policy via a...

8.8CVSS

8.1AI Score

0.011EPSS

2016-05-14 09:59 PM
45
4
cve
cve

CVE-2016-1666

Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.94 allow attackers to cause a denial of service or possibly have other impact via unknown...

9.8CVSS

9.2AI Score

0.006EPSS

2016-05-14 09:59 PM
45
cve
cve

CVE-2016-1665

The JSGenericLowering class in compiler/js-generic-lowering.cc in Google V8, as used in Google Chrome before 50.0.2661.94, mishandles comparison operators, which allows remote attackers to obtain sensitive information via crafted JavaScript...

6.5CVSS

7AI Score

0.005EPSS

2016-05-14 09:59 PM
50
cve
cve

CVE-2016-1664

The HistoryController::UpdateForCommit function in content/renderer/history_controller.cc in Google Chrome before 50.0.2661.94 mishandles the interaction between subframe forward navigations and other forward navigations, which allows remote attackers to spoof the address bar via a crafted web...

4.3CVSS

5.6AI Score

0.004EPSS

2016-05-14 09:59 PM
45
cve
cve

CVE-2016-1663

The SerializedScriptValue::transferArrayBuffers function in WebKit/Source/bindings/core/v8/SerializedScriptValue.cpp in the V8 bindings in Blink, as used in Google Chrome before 50.0.2661.94, mishandles certain array-buffer data structures, which allows remote attackers to cause a denial of...

8.8CVSS

9.1AI Score

0.008EPSS

2016-05-14 09:59 PM
55
cve
cve

CVE-2016-1662

extensions/renderer/gc_callback.cc in Google Chrome before 50.0.2661.94 does not prevent fallback execution once the Garbage Collection callback has started, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown...

9.8CVSS

9.2AI Score

0.022EPSS

2016-05-14 09:59 PM
44
cve
cve

CVE-2016-1661

Blink, as used in Google Chrome before 50.0.2661.94, does not ensure that frames satisfy a check for the same renderer process in addition to a Same Origin Policy check, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a...

8CVSS

8.6AI Score

0.004EPSS

2016-05-14 09:59 PM
54
cve
cve

CVE-2016-1660

Blink, as used in Google Chrome before 50.0.2661.94, mishandles assertions in the WTF::BitArray and WTF::double_conversion::Vector classes, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted web...

8.8CVSS

9.1AI Score

0.009EPSS

2016-05-14 09:59 PM
48
4
cve
cve

CVE-2016-4024

Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an image, which triggers an out-of-bounds heap memory write...

9.8CVSS

9AI Score

0.036EPSS

2016-05-13 04:59 PM
33
Total number of security vulnerabilities1478