Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2015-1265
Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=445741'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=413534'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=448057'}, {'name': 'openSUSE-SU-2015:0969', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=484270'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=464792'}, {'name': '37766', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/37766/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=485412'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=454157'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=467644'}, {'name': '74727', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/74727'}, {'name': 'GLSA-201506-04', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201506-04'}, {'name': 'openSUSE-SU-2015:1877', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html'}, {'name': '1032375', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032375'}, {'name': 'DSA-3267', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3267'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=476107'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=475070'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=465426'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=458026'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=474784'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=464642'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=489518'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=485419'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=467372'}]
CVE State: PUBLISHED
Explain CVE-2015-1266
content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated with a WebUI SiteInstance, which allows remote attackers to bypass intended access restrictions via a similar URL, as demonstrated by use of http://gpu when there is a WebUI class for handling chrome://gpu requests.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:1872', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-11/msg00012.html'}, {'name': '1032731', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032731'}, {'name': '75333', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75333'}, {'name': 'USN-2652-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2652-1'}, {'name': 'RHSA-2015:1188', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1188.html'}, {'name': 'openSUSE-SU-2015:1146', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-06/msg00057.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1129123004/'}, {'name': 'GLSA-201507-18', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201507-18'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=464922'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}]
CVE State: PUBLISHED
Explain CVE-2015-1267
Blink, as used in Google Chrome before 43.0.2357.130, does not properly restrict the creation context during creation of a DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that uses a Blink public API, related to WebArrayBufferConverter.cpp, WebBlob.cpp, WebDOMError.cpp, and WebDOMFileSystem.cpp.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:1872', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-11/msg00012.html'}, {'name': '1032731', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032731'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1174343003/'}, {'name': 'USN-2652-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2652-1'}, {'name': 'RHSA-2015:1188', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1188.html'}, {'name': 'openSUSE-SU-2015:1146', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-06/msg00057.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=497507'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.html'}, {'name': 'GLSA-201507-18', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201507-18'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://src.chromium.org/viewvc/blink?revision=196755&view=revision'}, {'name': '75334', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75334'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}]
CVE State: PUBLISHED
Explain CVE-2015-1268
bindings/scripts/v8_types.py in Blink, as used in Google Chrome before 43.0.2357.130, does not properly select a creation context for a return value's DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code, as demonstrated by use of a data: URL.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:1872', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-11/msg00012.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://src.chromium.org/viewvc/blink?revision=196373&view=revision'}, {'name': '1032731', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032731'}, {'name': '75332', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75332'}, {'name': 'USN-2652-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2652-1'}, {'name': 'RHSA-2015:1188', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1188.html'}, {'name': 'openSUSE-SU-2015:1146', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-06/msg00057.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=494640'}, {'name': 'GLSA-201507-18', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201507-18'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}]
CVE State: PUBLISHED
Explain CVE-2015-1269
The DecodeHSTSPreloadRaw function in net/http/transport_security_state.cc in Google Chrome before 43.0.2357.130 does not properly canonicalize DNS hostnames before making comparisons to HSTS or HPKP preload entries, which allows remote attackers to bypass intended access restrictions via a string that (1) ends in a . (dot) character or (2) is not entirely lowercase.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:1872', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-11/msg00012.html'}, {'name': '1032731', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032731'}, {'name': '75336', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75336'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1149753002'}, {'name': 'USN-2652-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2652-1'}, {'name': 'RHSA-2015:1188', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1188.html'}, {'name': 'openSUSE-SU-2015:1146', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-06/msg00057.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.html'}, {'name': 'GLSA-201507-18', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201507-18'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=461481'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}]
CVE State: PUBLISHED
Explain CVE-2015-1270
The ucnv_io_getConverterName function in common/ucnv_io.cpp in International Components for Unicode (ICU), as used in Google Chrome before 44.0.2403.89, mishandles converter names with initial x- substrings, which allows remote attackers to cause a denial of service (read of uninitialized memory) or possibly have unspecified other impact via a crafted file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1157143002/'}, {'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=444573'}, {'name': 'DSA-3360', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3360'}, {'name': 'USN-2740-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2740-1'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://chromium.googlesource.com/chromium/deps/icu/+/f1ad7f9ba957571dc692ea3e187612c685615e19'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1271
PDFium, as used in Google Chrome before 44.0.2403.89, does not properly handle certain out-of-memory conditions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted PDF document that triggers a large memory allocation.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1226403008'}, {'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=446032'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}]
CVE State: PUBLISHED
Explain CVE-2015-1272
Use-after-free vulnerability in the GPU process implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging the continued availability of a GPUChannelHost data structure during Blink shutdown, related to content/browser/gpu/browser_gpu_channel_host_factory.cc and content/renderer/render_thread_impl.cc.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1128233004/'}, {'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://codereview.chromium.org/867553003/'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=451456'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}]
CVE State: PUBLISHED
Explain CVE-2015-1273
Heap-based buffer overflow in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid JPEG2000 data in a PDF document.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://pdfium.googlesource.com/pdfium/+/cddfde0cddbc8467e0d5fa04c30405ee257750fc'}, {'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=459215'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}]
CVE State: PUBLISHED
Explain CVE-2015-1274
Google Chrome before 44.0.2403.89 does not ensure that the auto-open list omits all dangerous file types, which makes it easier for remote attackers to execute arbitrary code by providing a crafted file and leveraging a user's previous "Always open files of this type" choice, related to download_commands.cc and download_prefs.cc.
Affected Products: n/a
References: [{'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1165893004/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=461858'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}]
CVE State: PUBLISHED
Explain CVE-2015-1275
Cross-site scripting (XSS) vulnerability in org/chromium/chrome/browser/UrlUtilities.java in Google Chrome before 44.0.2403.89 on Android allows remote attackers to inject arbitrary web script or HTML via a crafted intent: URL, as demonstrated by a trailing alert(document.cookie);// substring, aka "Universal XSS (UXSS)."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1059413004/'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=462843'}]
CVE State: PUBLISHED
Explain CVE-2015-1276
Use-after-free vulnerability in content/browser/indexed_db/indexed_db_backing_store.cc in the IndexedDB implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging an abort action before a certain write operation.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=472614'}, {'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1060613002/'}]
CVE State: PUBLISHED
Explain CVE-2015-1277
Use-after-free vulnerability in the accessibility implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging lack of certain validity checks for accessibility-tree data structures.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=479743'}, {'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1144363004/'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1151393006/'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}]
CVE State: PUBLISHED
Explain CVE-2015-1278
content/browser/web_contents/web_contents_impl.cc in Google Chrome before 44.0.2403.89 does not ensure that a PDF document's modal dialog is closed upon navigation to an interstitial page, which allows remote attackers to spoof URLs via a crafted document, as demonstrated by the alert_dialog.pdf document.
Affected Products: n/a
References: [{'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1156663004/'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1150843002/'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=482380'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}]
CVE State: PUBLISHED
Explain CVE-2015-1279
Integer overflow in the CJBig2_Image::expand function in fxcodec/jbig2/JBig2_Image.cpp in PDFium, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via large height and stride values.
Affected Products: n/a
References: [{'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1241493002'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=483981'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1237723002'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}]
CVE State: PUBLISHED
Explain CVE-2015-1280
SkPictureShader.cpp in Skia, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging access to a renderer process and providing crafted serialized data.
Affected Products: n/a
References: [{'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1151663002'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=486947'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}]
CVE State: PUBLISHED
Explain CVE-2015-1281
core/loader/ImageLoader.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly determine the V8 context of a microtask, which allows remote attackers to bypass Content Security Policy (CSP) restrictions by providing an image from an unintended source.
Affected Products: n/a
References: [{'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://src.chromium.org/viewvc/blink?revision=196071&view=revision'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=487155'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}]
CVE State: PUBLISHED
Explain CVE-2015-1282
Multiple use-after-free vulnerabilities in fpdfsdk/src/javascript/Document.cpp in PDFium, as used in Google Chrome before 44.0.2403.89, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document, related to the (1) Document::delay and (2) Document::DoFieldDelay functions.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://pdfium.googlesource.com/pdfium/+/4ff7a4246c81a71b4f878e959b3ca304cd76ec8a'}, {'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=487928'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}]
CVE State: PUBLISHED
Explain CVE-2015-1283
Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.tenable.com/security/tns-2016-20'}, {'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=492052'}, {'name': 'openSUSE-SU-2016:1523', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00010.html'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'name': 'DSA-3318', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3318'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html'}, {'name': 'SUSE-SU-2016:1508', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00006.html'}, {'name': 'GLSA-201701-21', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201701-21'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://source.android.com/security/bulletin/2016-11-01.html'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'name': 'SUSE-SU-2016:1512', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00007.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1224303003'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'name': 'USN-2726-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2726-1'}, {'name': 'openSUSE-SU-2016:1441', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00064.html'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kc.mcafee.com/corporate/index?page=content&id=SB10365'}]
CVE State: PUBLISHED
Explain CVE-2015-1284
The LocalFrame::isURLAllowed function in core/frame/LocalFrame.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly check for a page's maximum number of frames, which allows remote attackers to cause a denial of service (invalid count value and use-after-free) or possibly have unspecified other impact via crafted JavaScript code that makes many createElement calls for IFRAME elements.
Affected Products: n/a
References: [{'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=493243'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://src.chromium.org/viewvc/blink?revision=197139&view=revision'}]
CVE State: PUBLISHED
Explain CVE-2015-1285
The XSSAuditor::canonicalize function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 44.0.2403.89, does not properly choose a truncation point, which makes it easier for remote attackers to obtain sensitive information via an unspecified linear-time attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=498982'}, {'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://src.chromium.org/viewvc/blink?revision=196971&view=revision'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}]
CVE State: PUBLISHED
Explain CVE-2015-1286
Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler.cc in Google Chrome before 44.0.2403.89 allows remote attackers to inject arbitrary web script or HTML by leveraging the lack of a certain V8 context restriction, aka a Blink "Universal XSS (UXSS)."
Affected Products: n/a
References: [{'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1235863003/'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=504011'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1231803002/'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}]
CVE State: PUBLISHED
Explain CVE-2015-1287
Blink, as used in Google Chrome before 44.0.2403.89, enables a quirks-mode exception that limits the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to core/fetch/CSSStyleSheetResource.cpp.
Affected Products: n/a
References: [{'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://src.chromium.org/viewvc/blink?revision=195266&view=revision'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=419383'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}]
CVE State: PUBLISHED
Explain CVE-2015-1288
The Spellcheck API implementation in Google Chrome before 44.0.2403.89 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file, a related issue to CVE-2015-1263.
Affected Products: n/a
References: [{'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1056103005'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=479162'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}]
CVE State: PUBLISHED
Explain CVE-2015-1289
Multiple unspecified vulnerabilities in Google Chrome before 44.0.2403.89 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=512110'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/506749'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/495682'}, {'name': 'RHSA-2015:1499', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1499.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/471990'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/458024'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/459898'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/404462'}, {'name': 'openSUSE-SU-2015:1287', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html'}, {'name': '1033031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/477713'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/487286'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/484432'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/485855'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/486004'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/398235'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/507821'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/504692'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/491216'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/478575'}, {'name': '75973', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/75973'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/401995'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/492981'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/460938'}, {'name': 'DSA-3315', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3315'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://crbug.com/492448'}]
CVE State: PUBLISHED
Explain CVE-2015-1290
The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1, allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted web site.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/changes-5.5.1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.chromium.org/p/chromium/issues/detail?id=505374'}, {'name': 'openSUSE-SU-2015:2368', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-12/msg00116.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.nsfocus.net/index.php?act=advisory&do=view&adv_id=80'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1233453004'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html'}]
CVE State: PUBLISHED
Explain CVE-2015-1291
The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not check whether a node is expected, which allows remote attackers to bypass the Same Origin Policy or cause a denial of service (DOM tree corruption) via a web site with crafted JavaScript code and IFRAME elements.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:1873', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://src.chromium.org/viewvc/blink?revision=200098&view=revision'}, {'name': 'RHSA-2015:1712', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1712.html'}, {'name': '1033472', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033472'}, {'name': 'openSUSE-SU-2015:1586', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html'}, {'name': 'DSA-3351', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3351'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=516377'}]
CVE State: PUBLISHED
Explain CVE-2015-1292
The NavigatorServiceWorker::serviceWorker function in modules/serviceworkers/NavigatorServiceWorker.cpp in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy by accessing a Service Worker.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:1873', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://codereview.chromium.org/1307883002/'}, {'name': 'RHSA-2015:1712', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-1712.html'}, {'name': '1033472', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1033472'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://src.chromium.org/viewvc/blink?revision=201055&view=revision'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=522791'}, {'name': 'openSUSE-SU-2015:1586', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html'}, {'name': 'DSA-3351', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3351'}, {'name': 'GLSA-201603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201603-09'}]
CVE State: PUBLISHED