Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-5128 State: PUBLISHED Published: 2016-07-23T19:00:00 Last Updated: 2024-08-06T00:53:47.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: objects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not prevent API interceptors from modifying a store target without setting a property, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00022.html - http://www.securityfocus.com/bid/92053 - http
tp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00022.html - http://www.securityfocus.com/bid/92053 - https://codereview.chromium.org/2101983002 - http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html - https://codereview.chromium.org/2082633002 - http://www.ubuntu.com/usn/USN-3041-1 - https://codereview.chromium.org/2085223002 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00028.html - https://codereview.chromium.org/2084183004 - https://codereview.chromium.org/2103033002 - https://security.gentoo.org/glsa/201610-09 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00020.html - http://rhn.redhat.com/errata/RHSA-2016-1485
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00020.html - http://rhn.redhat.com/errata/RHSA-2016-1485.html - https://crbug.com/619166 - http://www.securitytracker.com/id/1036428 - http://www.debian.org/security/2016/dsa-3637
CVE ID: CVE-2016-5129 State: PUBLISHED Published: 2016-07-23T19:00:00 Last Updated: 2024-08-06T00:53:47.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objects, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00022.html - https://source.android.com/security/bull
- http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00022.html - https://source.android.com/security/bulletin/2017-04-01 - http://www.securityfocus.com/bid/92053 - http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html - http://www.ubuntu.com/usn/USN-3041-1 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00028.html - https://codereview.chromium.org/2078403002/ - https://crbug.com/620553 - https://codereview.chromium.org/2102243002 - https://codereview.chromium.org/2111133002 - https://security.gentoo.org/glsa/201610-09 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00020.html - http://rhn.redhat.com/errata/RHSA-2016-148
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00020.html - http://rhn.redhat.com/errata/RHSA-2016-1485.html - http://www.securitytracker.com/id/1036428 - http://www.securitytracker.com/id/1038201 - http://www.debian.org/security/2016/dsa-3637
CVE ID: CVE-2016-5130 State: PUBLISHED Published: 2016-07-23T19:00:00 Last Updated: 2024-08-06T00:53:47.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: content/renderer/history_controller.cc in Google Chrome before 52.0.2743.82 does not properly restrict multiple uses of a JavaScript forward method, which allows remote attackers to spoof the URL display via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/623319 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00022.html - http://www.securityfocus.com/bid/92053 - http://googlechro
ensuse.org/opensuse-security-announce/2016-07/msg00022.html - http://www.securityfocus.com/bid/92053 - http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html - http://www.ubuntu.com/usn/USN-3041-1 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00028.html - https://bugs.chromium.org/p/chromium/issues/detail?id=626838 - https://codereview.chromium.org/2134493002/ - https://security.gentoo.org/glsa/201610-09 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00020.html - https://codereview.chromium.org/2144823002 - http://rhn.redhat.com/errata/RHSA-2016-1485.html - http://www.securitytracker.com/id/1036428 - http://www.debian.org/security/2
rhn.redhat.com/errata/RHSA-2016-1485.html - http://www.securitytracker.com/id/1036428 - http://www.debian.org/security/2016/dsa-3637
CVE ID: CVE-2016-5131 State: PUBLISHED Published: 2016-07-23T19:00:00 Last Updated: 2024-08-06T00:53:48.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1358641 - https://support.apple.com/HT207141 - https://crbug.com/623378 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00021.html - http://lists.opensuse
://crbug.com/623378 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00022.html - http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html - http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html - http://www.securityfocus.com/bid/92053 - http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html - http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html - http://www.ubuntu.com/usn/USN-3041-1 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00028.html - https://source.android.com/security/bulletin/2017-05-01 - https:
.org/opensuse-security-announce/2016-07/msg00028.html - https://source.android.com/security/bulletin/2017-05-01 - https://codereview.chromium.org/2127493002 - http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html - https://support.apple.com/HT207170 - https://security.gentoo.org/glsa/201610-09 - https://security.gentoo.org/glsa/201701-37 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00020.html - https://support.apple.com/HT207142 - https://support.apple.com/HT207143 - http://rhn.redhat.com/errata/RHSA-2016-1485.html - http://www.securitytracker.com/id/1038623 - http://www.securitytracker.com/id/1036428 - http://www.debian.org/security/2016/dsa-3637
CVE ID: CVE-2016-5132 State: PUBLISHED Published: 2016-07-23T19:00:00 Last Updated: 2024-08-06T00:53:47.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Service Workers subsystem in Google Chrome before 52.0.2743.82 does not properly implement the Secure Contexts specification during decisions about whether to control a subframe, which allows remote attackers to bypass the Same Origin Policy via an https IFRAME element inside an http IFRAME element. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00022.html - http://w
y-announce/2016-07/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00022.html - http://www.securityfocus.com/bid/92053 - http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html - http://www.ubuntu.com/usn/USN-3041-1 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00028.html - https://codereview.chromium.org/2061203002/ - https://codereview.chromium.org/2009453002 - https://codereview.chromium.org/2085923002 - https://codereview.chromium.org/2082493002/ - https://crbug.com/607543 - https://security.gentoo.org/glsa/201610-09 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00020.html - http://rhn.redhat.com/
org/glsa/201610-09 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00020.html - http://rhn.redhat.com/errata/RHSA-2016-1485.html - https://codereview.chromium.org/2071433003 - http://www.securitytracker.com/id/1036428 - http://www.debian.org/security/2016/dsa-3637
CVE ID: CVE-2016-5133 State: PUBLISHED Published: 2016-07-23T19:00:00 Last Updated: 2024-08-06T00:53:48.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google Chrome before 52.0.2743.82 mishandles origin information during proxy authentication, which allows man-in-the-middle attackers to spoof a proxy-authentication login prompt or trigger incorrect credential storage by modifying the client-server data stream. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00021.html - https://codereview.chromium.org/2067933002/ - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00022.html - http
/codereview.chromium.org/2067933002/ - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00022.html - http://www.securityfocus.com/bid/92053 - http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html - http://www.ubuntu.com/usn/USN-3041-1 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00028.html - https://crbug.com/613626 - https://security.gentoo.org/glsa/201610-09 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00020.html - http://rhn.redhat.com/errata/RHSA-2016-1485.html - http://www.securitytracker.com/id/1036428 - http://www.debian.org/security/2016/dsa-3637
CVE ID: CVE-2016-5134 State: PUBLISHED Published: 2016-07-23T19:00:00 Last Updated: 2024-08-06T00:53:47.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: net/proxy/proxy_service.cc in the Proxy Auto-Config (PAC) feature in Google Chrome before 52.0.2743.82 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, a related issue to CVE-2016-3763. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/877625 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00021.html - https://codereview.chromium.org/19967
625 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00021.html - https://codereview.chromium.org/1996773002 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00022.html - http://www.securityfocus.com/bid/92053 - http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html - http://www.ubuntu.com/usn/USN-3041-1 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00028.html - https://crbug.com/593759 - https://security.gentoo.org/glsa/201610-09 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00020.html - http://rhn.redhat.com/errata/RHSA-2016-1485.html - http://www.securitytracker.com/id/1036428 - http://www.debia
0.html - http://rhn.redhat.com/errata/RHSA-2016-1485.html - http://www.securitytracker.com/id/1036428 - http://www.debian.org/security/2016/dsa-3637
CVE ID: CVE-2016-5135 State: PUBLISHED Published: 2016-07-23T19:00:00 Last Updated: 2024-08-06T00:53:48.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not consider referrer-policy information inside an HTML document during a preload request, which allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a crafted web site, as demonstrated by a "Content-Security-Policy: referrer origin-when-cross-origin" header that overrides a "<META name='referrer' content='no-referrer'>" element. Additional Analyst Notes: - CVE Program Conta
r that overrides a "<META name='referrer' content='no-referrer'>" element. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00021.html - https://crbug.com/605451 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00022.html - http://www.securityfocus.com/bid/92053 - http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html - https://codereview.chromium.org/1913983002 - http://www.ubuntu.com/usn/USN-3041-1 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00028.html - https://security.gentoo.org/glsa/201610-09 - http://lists.opensuse.org/opensuse-security-announce/2
6-07/msg00028.html - https://security.gentoo.org/glsa/201610-09 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00020.html - http://rhn.redhat.com/errata/RHSA-2016-1485.html - http://www.securitytracker.com/id/1036428 - http://www.debian.org/security/2016/dsa-3637
CVE ID: CVE-2016-5136 State: PUBLISHED Published: 2016-07-23T19:00:00 Last Updated: 2024-08-06T00:53:48.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in extensions/renderer/user_script_injector.cc in the Extensions subsystem in Google Chrome before 52.0.2743.82 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to script deletion. Additional Analyst Notes: - CVE Program Container: References: - https://codereview.chromium.org/2134613002/ - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg0002
/opensuse-security-announce/2016-07/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00022.html - https://crbug.com/625393 - http://www.securityfocus.com/bid/92053 - http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00028.html - https://codereview.chromium.org/2116923002/ - https://security.gentoo.org/glsa/201610-09 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00020.html - http://rhn.redhat.com/errata/RHSA-2016-1485.html - http://www.securitytracker.com/id/1036428 - http://www.debian.org/security/2016/dsa-3637
CVE ID: CVE-2016-5137 State: PUBLISHED Published: 2016-07-23T19:00:00 Last Updated: 2024-08-06T00:53:47.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 52.0.2743.82, does not apply http :80 policies to https :443 URLs and does not apply ws :80 policies to wss :443 URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report. NOTE: this vulnerability is associated with a specification change after CVE-2016-1617 resolution. Addit
g a CSP report. NOTE: this vulnerability is associated with a specification change after CVE-2016-1617 resolution. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/625945 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00022.html - http://www.securityfocus.com/bid/92053 - http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html - http://www.ubuntu.com/usn/USN-3041-1 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00028.html - https://codereview.chromium.org/2125873003 - https://security.gentoo.org/glsa/201610-09 - http://lists.o
msg00028.html - https://codereview.chromium.org/2125873003 - https://security.gentoo.org/glsa/201610-09 - http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00020.html - http://rhn.redhat.com/errata/RHSA-2016-1485.html - http://www.securitytracker.com/id/1036428 - http://www.debian.org/security/2016/dsa-3637
CVE ID: CVE-2016-5138 State: PUBLISHED Published: 2016-08-01T01:00:00 Last Updated: 2024-08-06T00:53:47.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the kbasep_vinstr_attach_client function in midgard/mali_kbase_vinstr.c in Google Chrome before 52.0.2743.85 allows remote attackers to cause a denial of service (heap-based buffer overflow and use-after-free) by leveraging an unrestricted multiplication. Additional Analyst Notes: - CVE Program Container: References: - http://googlechromereleases.blogspot.com/2016/07/stable-channel-update-for-chrome-os_26.html - http://www.securityfocus.com/bid/92139 - https://chromium.googlesource.com/chromiumos/third_part
for-chrome-os_26.html - http://www.securityfocus.com/bid/92139 - https://chromium.googlesource.com/chromiumos/third_party/kernel/+/d65f7c158dabbb5b9e89723aceb30e874c2d748a - http://www.securitytracker.com/id/1036484 - https://security.gentoo.org/glsa/201610-09 - https://bugs.chromium.org/p/chromium/issues/detail?id=631752&desc=2
CVE ID: CVE-2016-5139 State: PUBLISHED Published: 2016-08-07T19:00:00 Last Updated: 2024-08-06T00:53:48.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00025.html - http://www.securityfocus.com/bid/92276 - https://crbug.com/625541 - http://lists.opensuse.org/opensuse-secu
00025.html - http://www.securityfocus.com/bid/92276 - https://crbug.com/625541 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00006.html - http://rhn.redhat.com/errata/RHSA-2016-1580.html - http://rhn.redhat.com/errata/RHSA-2017-0559.html - http://rhn.redhat.com/errata/RHSA-2017-0838.html - http://www.securitytracker.com/id/1036547 - https://security.gentoo.org/glsa/201610-09 - https://codereview.chromium.org/2124073003 - http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00005.html - http://www.debian.org/security/2016/dsa-3645 - https://lists.fedoraproject.org/archives/
nnounce/2016-08/msg00005.html - http://www.debian.org/security/2016/dsa-3645 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KMX62M7UNRLWO4FEQ6YIMPMTKXXJV6A/
CVE ID: CVE-2016-5140 State: PUBLISHED Published: 2016-08-07T19:00:00 Last Updated: 2024-08-06T00:53:47.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the opj_j2k_read_SQcd_SQcc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JPEG 2000 data. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/92276 - https://crbug.com/619405 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00006.html - http://rhn.redhat.com/errata/RHSA-2016-1580.html - htt
s.opensuse.org/opensuse-security-announce/2016-08/msg00006.html - http://rhn.redhat.com/errata/RHSA-2016-1580.html - https://codereview.chromium.org/2071773002 - http://www.securitytracker.com/id/1036547 - https://security.gentoo.org/glsa/201610-09 - http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00005.html - http://www.debian.org/security/2016/dsa-3645 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KMX62M7UNRLWO4FEQ6YIMPMTKXXJV6A/
CVE ID: CVE-2016-5141 State: PUBLISHED Published: 2016-08-07T19:00:00 Last Updated: 2024-08-06T00:53:48.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blink, as used in Google Chrome before 52.0.2743.116, allows remote attackers to spoof the address bar via vectors involving a provisional URL for an initially empty document, related to FrameLoader.cpp and ScopedPageLoadDeferrer.cpp. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/92276 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00006.html - http://rhn.redhat.com/errata/RHSA-2016-1580.html - https://codereview.chromium.org/2171063002 - http://www.securit
tml - http://rhn.redhat.com/errata/RHSA-2016-1580.html - https://codereview.chromium.org/2171063002 - http://www.securitytracker.com/id/1036547 - https://crbug.com/629542 - https://security.gentoo.org/glsa/201610-09 - http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00005.html - http://www.debian.org/security/2016/dsa-3645 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KMX62M7UNRLWO4FEQ6YIMPMTKXXJV6A/
CVE ID: CVE-2016-5142 State: PUBLISHED Published: 2016-08-07T19:00:00 Last Updated: 2024-08-06T00:53:47.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code, related to NormalizeAlgorithm.cpp and SubtleCrypto.cpp. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/92276 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00006.htm
es: - http://www.securityfocus.com/bid/92276 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00006.html - http://rhn.redhat.com/errata/RHSA-2016-1580.html - https://codereview.chromium.org/2141843002/ - http://www.securitytracker.com/id/1036547 - https://crbug.com/626948 - https://security.gentoo.org/glsa/201610-09 - http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00005.html - http://www.debian.org/security/2016/dsa-3645 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KMX62M7UNRLWO4FEQ6YIMPMTKXXJV6A/
CVE ID: CVE-2016-5143 State: PUBLISHED Published: 2016-08-07T19:00:00 Last Updated: 2024-08-06T00:53:47.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different vulnerability than CVE-2016-5144. Additional Analyst Notes: - CVE Program Container: References: - https://codereview.chromium.org/2065823004 - http://www.securityfocus.com/bid/92276 - http://lists.opensuse.org/opensuse-security-announce/
chromium.org/2065823004 - http://www.securityfocus.com/bid/92276 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00006.html - http://rhn.redhat.com/errata/RHSA-2016-1580.html - http://www.securitytracker.com/id/1036547 - https://crbug.com/619414 - https://security.gentoo.org/glsa/201610-09 - http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00005.html - http://www.debian.org/security/2016/dsa-3645 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KMX62M7UNRLWO4FEQ6YIMPMTKXXJV6A/