chromium-browser: heap use-after-free in v8 bindings

The ToV8Value function in content/child/v8valueconverterimpl.cc in the V8 bindings in Google Chrome before 51.0.2704.63 does not properly restrict use of getters and setters, which allows remote attackers to cause a denial of service use-after-free or possibly have unspecified other impact via...

CVE-2016-1677

uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain sensitive information by calling the decodeURI function and leveraging "type confusion."...

CVE-2016-1678

objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via crafted JavaScript code...

CVE-2016-1688

The regexp aka regular expression implementation in Google V8 before 5.0.71.40, as used in Google Chrome before 51.0.2704.63, mishandles external string sizes, which allows remote attackers to cause a denial of service out-of-bounds read via crafted JavaScript code...

FreeBSD : chromium -- multiple vulnerabilities (7da1da96-24bb-11e6-bd31-3065ec8fd3ec)

Google Chrome Releases reports : 9 security fixes in this release, including : - 574802 High CVE-2016-1660: Out-of-bounds write in Blink. Credit to Atte Kettunen of OUSPG. - 601629 High CVE-2016-1661: Memory corruption in cross-process frames. Credit to Wadih Matar. - 603732 High CVE-2016-1662:...

FreeBSD : chromium -- multiple vulnerabilities (4dfafa16-24ba-11e6-bd31-3065ec8fd3ec)

Google Chrome Releases reports : 5 security fixes in this release, including : - 605766 High CVE-2016-1667: Same origin bypass in DOM. Credit to Mariusz Mlynski. - 605910 High CVE-2016-1668: Same origin bypass in Blink V8 bindings. Credit to Mariusz Mlynski. - 606115 High CVE-2016-1669: Buffer...

UBUNTU-CVE-2016-1679

The ToV8Value function in content/child/v8valueconverterimpl.cc in the V8 bindings in Google Chrome before 51.0.2704.63 does not properly restrict use of getters and setters, which allows remote attackers to cause a denial of service use-after-free or possibly have unspecified other impact via...

Researcher Pockets $30,000 in Chrome Bounties

Security researcher Mariusz Mlynski is having a good month. Having cashed in earlier in May to the tune of $15,500, Mlynski pocketed another $30,000 courtesy of Google’s bug bounty program after four high-severity vulnerabilities were patched in the Chrome browser, each worth $7,500 to the...

CVE-2016-1677

uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain sensitive information by calling the decodeURI function and leveraging "type confusion."...

CVE-2016-1679

The ToV8Value function in content/child/v8valueconverterimpl.cc in the V8 bindings in Google Chrome before 51.0.2704.63 does not properly restrict use of getters and setters, which allows remote attackers to cause a denial of service use-after-free or possibly have unspecified other impact via...

CVE-2016-1678

objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via crafted JavaScript code...

CVE-2016-1688

The regexp aka regular expression implementation in Google V8 before 5.0.71.40, as used in Google Chrome before 51.0.2704.63, mishandles external string sizes, which allows remote attackers to cause a denial of service out-of-bounds read via crafted JavaScript code...

PT-2016-2161

Name of the Vulnerable Software and Affected Versions Google V8 versions prior to 5.1.281.26 Google Chrome versions prior to 51.0.2704.63 Description The issue is caused by the use of an incorrect array type in the uri.js component of the V8 browser engine. This allows remote attackers to obtain...

PT-2016-2159

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 51.0.2704.63 Opera versions prior to 51.0.2704.63 Description The issue is related to the ToV8Value function in the V8 bindings, which does not properly restrict the use of getters and setters. This allows remot...

PT-2016-2160

Name of the Vulnerable Software and Affected Versions Google V8 versions prior to 5.0.71.32 Google Chrome versions prior to 51.0.2704.63 Description The issue is caused by improper restrictions on lazy deoptimization in the objects.cc component of the V8 engine. This allows remote attackers to...

PT-2016-2150

Name of the Vulnerable Software and Affected Versions Google V8 versions prior to 5.0.71.40 Google Chrome versions prior to 51.0.2704.63 Description The issue is related to the regexp implementation in Google V8, which mishandles external string sizes. This allows remote attackers to cause a deni...

KLA10816 Multiple vulnerabilities in Google Chrome

Multiple serious vulnerabilities have been found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, obtain sensitive information or conduct another unknown impact. Below is a complete list of vulnerabilities: 1. Multiple...

CVE-2016-1859

The WebKit Canvas implementation in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site...

Ubuntu 14.04 LTS / 16.04 LTS : Oxide vulnerabilities (USN-2960-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2960-1 advisory. An out of bounds write was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potential...

USN-2960-1: Oxide vulnerabilities

An out of bounds write was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary code. CVE-2016-1660 It was discovered that Blink assumes that a frame...