Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-15370 State: PUBLISHED Published: 2017-10-16T04:00:00 Last Updated: 2024-08-05T19:57:25.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a heap-based buffer overflow in the ImaExpandS function of ima_rw.c in Sound eXchange (SoX) 14.4.2. A Crafted input will lead to a denial of service attack during conversion of an audio file. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2017/11/msg00043.html - https://bugzilla.redhat.com/show_bug.cgi?id=1500554 - https://security.gentoo.org/glsa/201810-02 - https://lists.debian.org/debian-lts-announce/2019/02/msg00042.html
CVE ID: CVE-2017-15371 State: PUBLISHED Published: 2017-10-16T04:00:00 Last Updated: 2024-08-05T19:57:25.718Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a reachable assertion abort in the function sox_append_comment() in formats.c in Sound eXchange (SoX) 14.4.2. A Crafted input will lead to a denial of service attack during conversion of an audio file. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2017/11/msg00043.html - https://security.gentoo.org/glsa/201810-02 - https://lists.debian.org/debian-lts-announce/2019/03/msg00007.html - https://bugzilla.redhat.com/show_bug.cgi?id=1500570
CVE ID: CVE-2017-15372 State: PUBLISHED Published: 2017-10-16T04:00:00 Last Updated: 2024-08-05T19:57:25.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a stack-based buffer overflow in the lsx_ms_adpcm_block_expand_i function of adpcm.c in Sound eXchange (SoX) 14.4.2. A Crafted input will lead to a denial of service attack during conversion of an audio file. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2017/11/msg00043.html - https://security.gentoo.org/glsa/201810-02 - https://bugzilla.redhat.com/show_bug.cgi?id=1500553 - https://lists.debian.org/debian-lts-announce/2019/02/msg00042.html
CVE ID: CVE-2017-15373 State: PUBLISHED Published: 2017-10-16T04:00:00Z Last Updated: 2024-09-17T04:09:55.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: E-Sic 1.0 allows SQL injection via the q parameter to esiclivre/restrito/inc/lkpcep.php (aka the search private area). Additional Analyst Notes: - CVE Program Container: References: - https://k33r0k.wordpress.com/2017/10/12/e-sic-sql-injection/ - https://www.exploit-db.com/exploits/42979/
CVE ID: CVE-2017-15374 State: PUBLISHED Published: 2017-10-16T04:00:00 Last Updated: 2024-08-05T19:57:25.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the customer and orders section of the backend. The execution occurs in the administrator backend listing when processing a preview of the customers (kunden) or orders (bestellungen). The injection can be performed interactively via user reg
a preview of the customers (kunden) or orders (bestellungen). The injection can be performed interactively via user registration or by manipulation of the order information inputs. The issue can be exploited by low privileged user accounts against higher privileged (admin or moderator) accounts. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43849/ - https://www.vulnerability-lab.com/get_content.php?id=1922
CVE ID: CVE-2017-15375 State: PUBLISHED Published: 2017-10-16T04:00:00Z Last Updated: 2024-09-17T00:25:48.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple client-side cross site scripting vulnerabilities have been discovered in the WpJobBoard v4.5.1 web-application for WordPress. The vulnerabilities are located in the `query` and `id` parameters of the `wpjb-email`, `wpjb-job`, `wpjb-application`, and `wpjb-membership` modules. Remote attackers are able to inject malicious script code to hijack admin session credentials via the backend, or to manipulate the backend on client-side performed requests. The attack vector is non-persistent and the request method to inject
ate the backend on client-side performed requests. The attack vector is non-persistent and the request method to inject is GET. The attacker does not need a privileged user account to perform a successful exploitation. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=1941
CVE ID: CVE-2017-15376 State: PUBLISHED Published: 2017-10-16T04:00:00Z Last Updated: 2024-09-17T04:04:23.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TELNET service in Mobatek MobaXterm 10.4 does not require authentication, which allows remote attackers to execute arbitrary commands via TCP port 23. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2097
CVE ID: CVE-2017-15377 State: PUBLISHED Published: 2017-10-23T08:00:00 Last Updated: 2024-08-05T19:57:25.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Suricata before 4.x, it was possible to trigger lots of redundant checks on the content of crafted network traffic with a certain signature, because of DetectEngineContentInspection in detect-engine-content-inspection.c. The search engine doesn't stop when it should after no match is found; instead, it stops only upon reaching inspection-recursion-limit (3000 by default). Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/12/msg00000.html - https://redmine.ope
rogram Container: References: - https://lists.debian.org/debian-lts-announce/2018/12/msg00000.html - https://redmine.openinfosecfoundation.org/issues/2231 - https://github.com/OISF/suricata/commit/b9579fbe7dd408200ef03cbe20efddb624b73885
CVE ID: CVE-2017-15378 State: PUBLISHED Published: 2017-10-23T08:00:00 Last Updated: 2024-08-05T19:57:25.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the E-Sic 1.0 password reset parameter (aka the cpfcnpj parameter to the /reset URI). Additional Analyst Notes: - CVE Program Container: References: - http://whiteboyz.xyz/esic-software-publico-sql-injection.html - https://www.exploit-db.com/exploits/42981/
CVE ID: CVE-2017-15379 State: PUBLISHED Published: 2017-10-23T08:00:00 Last Updated: 2024-08-05T19:57:25.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication bypass exists in the E-Sic 1.0 /index (aka login) URI via '=''or' values for the username and password. Additional Analyst Notes: - CVE Program Container: References: - http://whiteboyz.xyz/esic-software-publico-autentication-bypass.html - https://www.exploit-db.com/exploits/42980/
CVE ID: CVE-2017-15380 State: PUBLISHED Published: 2017-10-23T08:00:00 Last Updated: 2024-08-05T19:57:25.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in the E-Sic 1.0 /cadastro/index.php URI (aka the requester's registration area) via the nome parameter. Additional Analyst Notes: - CVE Program Container: References: - http://whiteboyz.xyz/esic-software-publico-xss.html - https://www.exploit-db.com/exploits/42983/
CVE ID: CVE-2017-15381 State: PUBLISHED Published: 2017-10-23T08:00:00 Last Updated: 2024-08-05T19:57:25.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in E-Sic 1.0 via the f parameter to esiclivre/restrito/inc/buscacep.php (aka the zip code search script). Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42982/
CVE ID: CVE-2017-15383 State: PUBLISHED Published: 2017-10-16T17:00:00Z Last Updated: 2024-09-17T00:11:49.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nero 7.10.1.0 has an unquoted BINARY_PATH_NAME for NBService, exploitable via a Trojan horse Nero.exe file in the %PROGRAMFILES(x86)%\Nero directory. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/139658/Nero-7.10.1.0-Privilege-Escalation.html - https://cxsecurity.com/issue/WLB-2016110092
CVE ID: CVE-2017-15384 State: PUBLISHED Published: 2017-10-16T17:00:00Z Last Updated: 2024-09-16T20:36:22.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: rate-me.php in Rate Me 1.0 has XSS via the id field in a rate action. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2016110122 - https://packetstormsecurity.com/files/139696/ratemephp-xss.txt
CVE ID: CVE-2017-15385 State: PUBLISHED Published: 2017-10-16T22:00:00Z Last Updated: 2024-09-16T19:36:58.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: The store_versioninfo_gnu_verdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service (r_read_le16 invalid write and application crash) or possibly have unspecified other impact via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/issues/8685 - https://github.com/radare/radare2/commit/21a6f570ba33fa9f52f1bba87f07acc4e8c178f4
CVE ID: CVE-2017-15386 State: PUBLISHED Published: 2018-02-07T23:00:00 Last Updated: 2024-08-05T19:57:25.942Z Vendors: n/a Products: Google Chrome prior to 62.0.3202.62 Problem Types: Incorrect security UI Description: Incorrect implementation in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/752003 - http://www.securityfocus.com/bid/101482 - https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html - https://www.debian.org/security/2017/dsa-4020 - https://access.redhat.com/errata/RHSA-201
nnel-update-for-desktop.html - https://www.debian.org/security/2017/dsa-4020 - https://access.redhat.com/errata/RHSA-2017:2997 - https://security.gentoo.org/glsa/201710-24
CVE ID: CVE-2017-15387 State: PUBLISHED Published: 2018-02-07T23:00:00 Last Updated: 2024-08-05T19:57:25.597Z Vendors: n/a Products: Google Chrome prior to 62.0.3202.62 Problem Types: Insufficient Policy Enforcement Description: Insufficient enforcement of Content Security Policy in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to open javascript: URL windows when they should not be allowed to via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101482 - https://crbug.com/756040 - https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html - https://www.debian.org/security/
https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html - https://www.debian.org/security/2017/dsa-4020 - https://access.redhat.com/errata/RHSA-2017:2997 - https://security.gentoo.org/glsa/201710-24
CVE ID: CVE-2017-15388 State: PUBLISHED Published: 2018-02-07T23:00:00 Last Updated: 2024-08-05T19:57:25.765Z Vendors: n/a Products: Google Chrome prior to 62.0.3202.62 Problem Types: Out-of-bounds Read Description: Iteration through non-finite points in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101482 - https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html - https://crbug.com/756563 - https://www.debian.org/security/2017/dsa-4020 - https://access.redhat.com/errata/RHSA-201
l - https://crbug.com/756563 - https://www.debian.org/security/2017/dsa-4020 - https://access.redhat.com/errata/RHSA-2017:2997 - https://security.gentoo.org/glsa/201710-24
CVE ID: CVE-2017-15389 State: PUBLISHED Published: 2018-02-07T23:00:00 Last Updated: 2024-08-05T19:57:25.729Z Vendors: n/a Products: Google Chrome prior to 62.0.3202.62 Problem Types: Inappropriate implementation Description: An insufficient watchdog timer in navigation in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101482 - https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html - https://www.debian.org/security/2017/dsa-4020 - https://access.redhat.com/errata/RHSA-2017:2997 -
te-for-desktop.html - https://www.debian.org/security/2017/dsa-4020 - https://access.redhat.com/errata/RHSA-2017:2997 - https://security.gentoo.org/glsa/201710-24 - https://crbug.com/739621
CVE ID: CVE-2017-15390 State: PUBLISHED Published: 2018-02-07T23:00:00 Last Updated: 2024-08-05T19:57:25.674Z Vendors: n/a Products: Google Chrome prior to 62.0.3202.62 Problem Types: Insufficient Policy Enforcement Description: Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101482 - https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html - https://www.debian.org/security/2017/dsa-4020 - https://crbug.com/750239 - https://access.redhat.
ate-for-desktop.html - https://www.debian.org/security/2017/dsa-4020 - https://crbug.com/750239 - https://access.redhat.com/errata/RHSA-2017:2997 - https://security.gentoo.org/glsa/201710-24
CVE ID: CVE-2017-15391 State: PUBLISHED Published: 2018-02-07T23:00:00 Last Updated: 2024-08-05T19:57:25.675Z Vendors: n/a Products: Google Chrome prior to 62.0.3202.62 Problem Types: Insufficient Policy Enforcement Description: Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to access Extension pages without authorisation via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101482 - https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html - https://www.debian.org/security/2017/dsa-4020 - https://access.redhat.com/errata/RHSA-2017:29
-update-for-desktop.html - https://www.debian.org/security/2017/dsa-4020 - https://access.redhat.com/errata/RHSA-2017:2997 - https://crbug.com/598265 - https://security.gentoo.org/glsa/201710-24
CVE ID: CVE-2017-15392 State: PUBLISHED Published: 2018-02-07T23:00:00 Last Updated: 2024-08-05T19:57:26.043Z Vendors: n/a Products: Google Chrome prior to 62.0.3202.62 Problem Types: Insufficient data validation Description: Insufficient data validation in V8 in Google Chrome prior to 62.0.3202.62 allowed an attacker who can write to the Windows Registry to potentially exploit heap corruption via a crafted Windows Registry entry, related to PlatformIntegration. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101482 - https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html - https://crbug.com/714401 - https://www.
//chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html - https://crbug.com/714401 - https://www.debian.org/security/2017/dsa-4020 - https://access.redhat.com/errata/RHSA-2017:2997 - https://security.gentoo.org/glsa/201710-24
CVE ID: CVE-2017-15393 State: PUBLISHED Published: 2018-02-07T23:00:00 Last Updated: 2024-08-05T19:57:25.791Z Vendors: n/a Products: Google Chrome prior to 62.0.3202.62 Problem Types: Insufficient Policy Enforcement Description: Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugging functionality via a crafted HTML page, aka a Referer leak. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101482 - https://crbug.com/732751 - https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html - https://www.debian.org/secur
51 - https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html - https://www.debian.org/security/2017/dsa-4020 - https://access.redhat.com/errata/RHSA-2017:2997 - https://security.gentoo.org/glsa/201710-24
CVE ID: CVE-2017-15394 State: PUBLISHED Published: 2018-02-07T23:00:00 Last Updated: 2024-08-05T19:57:25.764Z Vendors: n/a Products: Google Chrome prior to 62.0.3202.62 Problem Types: Insufficient Policy Enforcement Description: Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing in permission dialogs via IDN homographs in a crafted Chrome Extension. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101482 - https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html - https://www.debian.org/security/2017/dsa-4020 - https://crbug.com/7
com/2017/10/stable-channel-update-for-desktop.html - https://www.debian.org/security/2017/dsa-4020 - https://crbug.com/745580 - https://access.redhat.com/errata/RHSA-2017:2997 - https://security.gentoo.org/glsa/201710-24
CVE ID: CVE-2017-15395 State: PUBLISHED Published: 2018-02-07T23:00:00 Last Updated: 2024-08-05T19:57:25.715Z Vendors: n/a Products: Google Chrome prior to 62.0.3202.62 Problem Types: Use After Free Description: A use after free in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka an ImageCapture NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101482 - https://crbug.com/759457 - https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html - https://www.debian.org/security/2017/dsa-4020 - https://access.red
.com/2017/10/stable-channel-update-for-desktop.html - https://www.debian.org/security/2017/dsa-4020 - https://access.redhat.com/errata/RHSA-2017:2997 - https://security.gentoo.org/glsa/201710-24
CVE ID: CVE-2017-15396 State: PUBLISHED Published: 2018-08-28T20:00:00 Last Updated: 2024-08-05T19:57:25.812Z Vendors: n/a Products: Google Chrome prior to 62.0.3202.75 unknown Problem Types: Stack buffer overflow Description: A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google Chrome prior to 62.0.3202.75 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.icu-project.org/trac/changeset/40494 - https://access.redhat.com/errata/RHSA-2017:3082 - https://crbug.com/770452 - https
cu-project.org/trac/changeset/40494 - https://access.redhat.com/errata/RHSA-2017:3082 - https://crbug.com/770452 - https://www.debian.org/security/2017/dsa-4020 - http://www.securityfocus.com/bid/101597 - https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html - https://security.gentoo.org/glsa/201711-02
CVE ID: CVE-2017-15397 State: PUBLISHED Published: 2018-02-07T23:00:00 Last Updated: 2024-08-05T19:57:25.920Z Vendors: n/a Products: Google Chrome OS prior to 62.0.3202.74 Problem Types: Inappropriate implementation Description: Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker in a privileged network position to observe or tamper with certain cleartext HTTP requests by leveraging that position. Additional Analyst Notes: - CVE Program Container: References: - https://wwws.nightwatchcybersecurity.com/2018/01/01/chromeos-doesnt-always-use-ssl-during-startup-cve-2017-15397/ - http://www.securityfocus.com/bid/102435 - https://chromerele
meos-doesnt-always-use-ssl-during-startup-cve-2017-15397/ - http://www.securityfocus.com/bid/102435 - https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-chrome-os_27.html - https://crbug.com/627300
CVE ID: CVE-2017-15398 State: PUBLISHED Published: 2018-08-28T20:00:00 Last Updated: 2024-08-05T19:57:25.806Z Vendors: n/a Products: Google Chrome prior to 62.0.3202.89 unknown Problem Types: Stack buffer overflow Description: A stack buffer overflow in the QUIC networking stack in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to gain code execution via a malicious server. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html - http://www.securityfocus.com/bid/101692 - https://www.debian.org/security/2017/dsa-4024 - https://crbug.com/777728 - https://security.gentoo.org/glsa/201711
692 - https://www.debian.org/security/2017/dsa-4024 - https://crbug.com/777728 - https://security.gentoo.org/glsa/201711-02 - https://access.redhat.com/errata/RHSA-2017:3151
CVE ID: CVE-2017-15399 State: PUBLISHED Published: 2018-08-28T20:00:00 Last Updated: 2024-08-05T19:57:25.914Z Vendors: n/a Products: Google Chrome prior to 62.0.3202.89 unknown Problem Types: Use after free Description: A use after free in V8 in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html - http://www.securityfocus.com/bid/101692 - https://www.debian.org/security/2017/dsa-4024 - https://crbug.com/776677 - https://security.gentoo.org/glsa/201711-02 - https://access
bian.org/security/2017/dsa-4024 - https://crbug.com/776677 - https://security.gentoo.org/glsa/201711-02 - https://access.redhat.com/errata/RHSA-2017:3151
CVE ID: CVE-2017-15400 State: PUBLISHED Published: 2018-02-07T23:00:00 Last Updated: 2024-08-05T19:57:26.090Z Vendors: n/a Products: Google Chrome OS prior to 62.0.3202.74 Problem Types: Script injection Description: Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command with the same privileges as the cups daemon via a crafted PPD file, aka a printer zeroconfig CRLF issue. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4243 - https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-chrome-os_27.html - https://crbug.com/777215 - https://s
chromereleases.googleblog.com/2017/10/stable-channel-update-for-chrome-os_27.html - https://crbug.com/777215 - https://security.gentoo.org/glsa/201908-08
CVE ID: CVE-2017-15401 State: PUBLISHED Published: 2019-01-09T19:00:00 Last Updated: 2024-08-05T19:57:25.928Z Vendors: Google Products: Chrome Problem Types: Out of bounds read and write Description: A memory corruption bug in WebAssembly could lead to out of bounds read and write through V8 in WebAssembly in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/766260 - https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-chrome-os_27.html
CVE ID: CVE-2017-15402 State: PUBLISHED Published: 2019-01-09T19:00:00 Last Updated: 2024-08-05T19:57:25.874Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Using an ID that can be controlled by a compromised renderer which allows any frame to overwrite the page_state of any other frame in the same process in Navigation in Google Chrome on Chrome OS prior to 62.0.3202.74 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/766262 - https://chromereleases.googleblog.com/2017/10/stable-channe