Google Chrome Blink CORS Bypass Vulnerability

Google Chrome is a Web browser from Google, a U.S. company. Blink is a browser layout engine rendering engine jointly developed by Google and Norway's OperaSoftware. A security vulnerability exists in Blink in versions of Google Chrome prior to 74.0.3729.108. The vulnerability can be exploited by...

Core: NCL - SocketsHttpHandler mishandling 1xx response as a final response leads to info disclosure

An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing CORS configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .N...

chromium-browser: CORS bypass in Blink

Information leak in media engine in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page...

USN-3714-1 thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass CORS restrictions, obtain sensitive information, or execute arbitrary...

CVE-2017-5069

Incorrect MIME type of XSS-Protection reports in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to circumvent Cross-Origin Resource Sharing checks via a crafted HTML page...

Security update for chromium (important)

This update to Chromium 58.0.3029.81 fixes the following security issues bsc1035103: - CVE-2017-5057: Type confusion in PDFium - CVE-2017-5058: Heap use after free in Print Preview - CVE-2017-5059: Type confusion in Blink - CVE-2017-5060: URL spoofing in Omnibox - CVE-2017-5061: URL spoofing in...

openSUSE Security Update : chromium (openSUSE-2017-508)

This update to Chromium 58.0.3029.81 fixes the following security issues bsc1035103 : - CVE-2017-5057: Type confusion in PDFium - CVE-2017-5058: Heap use after free in Print Preview - CVE-2017-5059: Type confusion in Blink - CVE-2017-5060: URL spoofing in Omnibox - CVE-2017-5061: URL spoofing in...

OPENSUSE-SU-2017:1098-1 Security update for chromium

This update to Chromium 58.0.3029.81 fixes the following security issues bsc1035103: - CVE-2017-5057: Type confusion in PDFium - CVE-2017-5058: Heap use after free in Print Preview - CVE-2017-5059: Type confusion in Blink - CVE-2017-5060: URL spoofing in Omnibox - CVE-2017-5061: URL spoofing in...

Google Chrome Security Updates (stable-channel-update-for-desktop-2017-04) - Linux

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 58 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 58.0.3029.81 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 29 security fixes in this release, including: 695826 High CVE-2017-5057: Type confusion in PDFium. Credit to Guang Gong of Alpha Team, Qihoo 360 694382 High CVE-2017-5058: Heap use after free in Print Preview. Credit to Khalil Zhani 684684 High CVE-2017-5059: Type...

CVE-2016-5192

Blink in Google Chrome prior to 54.0.2840.59 for Windows missed a CORS check on redirect in TextTrackLoader, which allowed a remote attacker to bypass cross-origin restrictions via crafted HTML pages...

Apple iTunes < 12.5.2 Multiple Vulnerabilities (credentialed check)

The version of Apple iTunes installed on the remote Windows host is prior to 12.5.2. It is, therefore, affected by multiple vulnerabilities : - A cross-origin bypass vulnerability exists in WebKit due to improper handling of the location attribute. An unauthenticated, remote attacker can exploit...

FreeBSD : chromium -- multiple vulnerabilities (9118961b-9fa5-11e6-a265-3065ec8fd3ec)

Google Chrome Releases reports : 21 security fixes in this release, including : - 645211 High CVE-2016-5181: Universal XSS in Blink. Credit to Anonymous - 638615 High CVE-2016-5182: Heap overflow in Blink. Credit to Giwan Go of STEALIEN - 645122 High CVE-2016-5183: Use after free in PDFium. Credi...

Google Chrome Blink Cross-Origin Bypass Vulnerability

Google Chrome is a popular web browser. A cross-origin bypass vulnerability exists in Google Chrome Blink. An attacker can exploit to bypass security restrictions...

chromium-browser: cross-origin bypass in blink

Blink in Google Chrome prior to 54.0.2840.59 for Windows missed a CORS check on redirect in TextTrackLoader, which allowed a remote attacker to bypass cross-origin restrictions via crafted HTML pages...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 21 security fixes in this release, including: 645211 High CVE-2016-5181: Universal XSS in Blink. Credit to Anonymous 638615 High CVE-2016-5182: Heap overflow in Blink. Credit to Giwan Go of STEALIEN 645122 High CVE-2016-5183: Use after free in PDFium. Credit to...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 54 to the stable channel - 54.0.2840.59 for Windows, Mac, and Linux. This will roll out over the coming days/weeks. Chrome 54.0.2840.59 contains a number of fixes and improvements -- a list of changes is available in the log. Watch...

Google Chrome < 51.0.2704.79 Multiple Vulnerabilities

Binary data 9373.pasl...

MGASA-2016-0218 Updated chromium-browser-stable/libpng packages fix security vulnerability

Chromium-browser-stable 51.0.2704.79 fixes security issues: cross-origin bypass problems in extension bindings CVE-2016-1696 and blink CVE-2016-1697, an information leak in extension bindings CVE-2016-1698, a parameter sanitization failure in devtools CVE-2016-1699, use-after-free bugs in...