CVE-2017-2445

CVE-2017-2445 is a UXSS/ cross-site scripting issue in WebKit used by Safari on iOS (and Safari/tvOS WebKit variants). The root cause is a validation/memory handling weakness in frame objects that can be triggered by crafted web content, enabling remote UXSS attacks. Affected platforms include iO...

CVE-2017-2393

An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Safari Reader" component. It allows remote attackers to conduct Universal XSS UXSS attacks via a crafted web site...

CVE-2017-2475

CVE-2017-2475 affects WebKitGTK+ (and WebKit in related builds) with UXSS via crafted frames on malicious websites. Public docs in connected sources describe CVE-2017-2475 as a cross-site scripting/UXSS issue in WebKit components. Mitigation as per Gentoo and Arch Linux advisories is to upgrade W...

CVE-2017-2475

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS UXSS attacks via crafted use of frames on a web site...

CVE-2017-2445

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS UXSS attacks via crafted frame objects...

openSUSE Security Update : chromium (openSUSE-2017-273)

Google chromium was updated to 56.0.2924.87 : - Various small fixes - Disabled option to enable/disable plugins in the chrome://plugins - Changed the build requirement of libavformat to library version 57.41.100, as included in ffmpeg 3.1.1, as only this version properly supports the public...

OPENSUSE-SU-2017:0565-1 Security update of chromium

Google chromium was updated to 56.0.2924.87: Various small fixes Disabled option to enable/disable plugins in the chrome://plugins - Changed the build requirement of libavformat to library version 57.41.100, as included in ffmpeg 3.1.1, as only this version properly supports the public AVStream A...

chromium-browser: universal xss in blink

Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed attacker controlled JavaScript to be run during the invocation of a private script method, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML pag...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 56 to the stable channel - 56.0.2924.76 for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 56.0.2924.76 contains a number of fixes and improvements -- a list of changes is available in the log. Watch o...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 55 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 55.0.2883.75 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming...

FreeBSD : chromium -- multiple vulnerabilities (9118961b-9fa5-11e6-a265-3065ec8fd3ec)

Google Chrome Releases reports : 21 security fixes in this release, including : - 645211 High CVE-2016-5181: Universal XSS in Blink. Credit to Anonymous - 638615 High CVE-2016-5182: Heap overflow in Blink. Credit to Giwan Go of STEALIEN - 645122 High CVE-2016-5183: Use after free in PDFium. Credi...

OPENSUSE-SU-2016:2597-1 Security update for Chromium

Chromium was updated to 54.0.2840.59 to fix security issues and bugs. The following security issues are fixed bnc1004465: - CVE-2016-5181: Universal XSS in Blink - CVE-2016-5182: Heap overflow in Blink - CVE-2016-5183: Use after free in PDFium - CVE-2016-5184: Use after free in PDFium -...

SUSE-SU-2016:2598-1 Security update for Chromium

Chromium was updated to 54.0.2840.59 to fix security issues and bugs. The following security issues are fixed bnc1004465: - CVE-2016-5181: Universal XSS in Blink - CVE-2016-5182: Heap overflow in Blink - CVE-2016-5183: Use after free in PDFium - CVE-2016-5184: Use after free in PDFium -...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 21 security fixes in this release, including: 645211 High CVE-2016-5181: Universal XSS in Blink. Credit to Anonymous 638615 High CVE-2016-5182: Heap overflow in Blink. Credit to Giwan Go of STEALIEN 645122 High CVE-2016-5183: Use after free in PDFium. Credit to...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 54 to the stable channel - 54.0.2840.59 for Windows, Mac, and Linux. This will roll out over the coming days/weeks. Chrome 54.0.2840.59 contains a number of fixes and improvements -- a list of changes is available in the log. Watch...

CVE-2016-4618

Cross-site scripting XSS vulnerability in Safari Reader in Apple iOS before 10 and Safari before 10 allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS UXSS."...

Cross site scripting

Cross-site scripting XSS vulnerability in Safari Reader in Apple iOS before 10 and Safari before 10 allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS UXSS."...

CVE-2016-4618

CVE-2016-4618 is a UXSS/XSS in Safari Reader affecting iOS prior to 10 and Safari prior to 10. The root cause is multiple input/validation flaws in Safari Reader that allow crafted pages to execute arbitrary script when loaded. Impact is remote code execution via a malicious webpage in the User’s...

CVE-2016-4618

Cross-site scripting XSS vulnerability in Safari Reader in Apple iOS before 10 and Safari before 10 allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS UXSS."...

Updated chromium-browser-stable packages fix security vulnerability

Blink, as used in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles deferred page loads, which allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS UXSS." CVE-2016-5147 Cross-site scripting XSS...