DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Google Chrome: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2017-12-06
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Chrome ausnutzen, um Informationen einzusehen, Sicherheitsmechanismen zu umgehen, Daten zu manipulieren, einen Denial of Service herbeizuführen oder Code mit den Privilegien des Angegriffenen zur Ausführung zu bringen.
01
beschreibt (19)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2017-15427US | medium6.1 | — | ||
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL in… | ||||
| CVE-2017-15426US | medium6.5 | — | ||
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. | ||||
| CVE-2017-15425US | medium6.5 | — | ||
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. | ||||
| CVE-2017-15424US | medium6.5 | — | ||
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. | ||||
| CVE-2017-15423US | medium5.3 | — | ||
Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512(password) by inspecting proto… | ||||
| CVE-2017-15422US | medium6.5 | — | ||
Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other… | ||||
| CVE-2017-15420US | medium6.5 | — | ||
Incorrect handling of back navigations in error pages in Navigation in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to spoof the contents of the Omnibox (URL bar)… | ||||
| CVE-2017-15419US | medium6.5 | — | ||
Insufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to infer browsing history by triggering a leaked cross-origi… | ||||
| CVE-2017-15418US | medium4.3 | — | ||
Use of uninitialized memory in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted H… | ||||
| CVE-2017-15417US | medium5.3 | — | ||
Inappropriate implementation in Skia canvas composite operations in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | ||||
| CVE-2017-15416US | medium6.5 | — | ||
Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka a Blink out-of… | ||||
| CVE-2017-15415US | medium6.5 | — | ||
Incorrect serialization in IPC in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the value of a pointer via a crafted HTML page. | ||||
| CVE-2017-15413US | high8.8 | — | ||
Type confusion in WebAssembly in V8 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||||
| CVE-2017-15412US | high8.8 | — | ||
Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a cr… | ||||
| CVE-2017-15411US | high8.8 | — | ||
Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. | ||||
| CVE-2017-15410US | high8.8 | — | ||
Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. | ||||
| CVE-2017-15409US | high8.8 | — | ||
Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||||
| CVE-2017-15408US | high8.8 | — | ||
Heap buffer overflow in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file that is mishandled by… | ||||
| CVE-2017-15407US | high8.8 | — | ||
Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to gain code execution via a malicious server. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Debian Security Advisory DSA-4103 vom 2018-02-01external
- Ubuntu Security Notice USN-3513-1 vom 2017-12-13external
- Ubuntu Security Notice USN-3513-2 vom 2017-12-13external
- Ubuntu Security Notice USN-3610-1 vom 2018-03-29external
- Red Hat Security Advisory RHSA-2017:3401 vom 2017-12-07external
- Red Hat Security Advisory RHSA-2018:0287 vom 2018-02-08external
- Red Hat Security Advisory RHSA-2020:1190 vom 2020-03-31external
- https://chromereleases.googleblog.com/ vom 2017-12-06external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan