alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2015-1155 (published 2015-05-08)
The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and read arbitrary files via a crafted web site.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Weakness: CWE-264
Affected vendors: apple
Affected products: iphone_os, safari
CVE-2015-1156 (published 2015-05-08)
The page-loading implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, does not properly handle the rel attribute in an A element, which allows remote attackers to bypass the Same Origin Policy for a link's target, and spoof the user interface, via a crafted web site.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-264
Affected vendors: apple
Affected products: iphone_os, safari
CVE-2015-1157 (published 2015-05-28)
CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature, as demonstrated by Arabic characters in (1) an SMS message or (2) a WhatsApp message.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-17
Affected vendors: apple
Affected products: iphone_os, itunes, mac_os_x
CVE-2015-1158 (published 2015-06-26)
The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-254
Affected vendors: cups
Affected products: cups
CVE-2015-1159 (published 2015-06-26)
Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: cups
Affected products: cups
CVE-2015-1164 (published 2015-01-21)
Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Affected vendors: serve-static_project
Affected products: serve-static
CVE-2015-1165 (published 2015-03-09)
RT (aka Request Tracker) 3.8.8 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to obtain sensitive RSS feed URLs and ticket data via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: bestpractical, debian, fedoraproject
Affected products: debian_linux, fedora, request_tracker
CVE-2015-1169 (published 2015-02-10)
Apereo Central Authentication Service (CAS) Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a wildcard and a valid password to bypass LDAP authentication.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-74
Affected vendors: apereo
Affected products: central_authentication_service
CVE-2015-1170 (published 2015-03-06)
The NVIDIA Display Driver R304 before 309.08, R340 before 341.44, R343 before 345.20, and R346 before 347.52 does not properly validate local client impersonation levels when performing a "kernel administrator check," which allows local users to gain administrator privileges via unspecified API calls.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: nvidia
Affected products: gpu_driver_r304, gpu_driver_r340, gpu_driver_r343, gpu_driver_r346
CVE-2015-1171 (published 2015-08-28)
Stack-based buffer overflow in GSM SIM Utility (aka SIM Card Editor) 6.6 allows remote attackers to execute arbitrary code via a long entry in a .sms file.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-119
Affected vendors: gsm
Affected products: sim_card_editor
CVE-2015-1172 (published 2015-02-11)
Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 and earlier for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an unspecified directory.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: holding_pattern_project
Affected products: holding_pattern
CVE-2015-1173 (published 2015-09-16)
Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 does not properly restrict access to the (1) Design Mode and (2) Debug Logger mode modules, which allows remote attackers to gain privileges via crafted "received parameters."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-284
Affected vendors: unit4
Affected products: teta_web
CVE-2015-1174 (published 2017-08-02)
Session fixation vulnerability in Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a session id.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-384
Affected vendors: unit4
Affected products: teta_web
CVE-2015-1175 (published 2015-01-22)
Cross-site scripting (XSS) vulnerability in blocklayered-ajax.php in the blocklayered module in PrestaShop 1.6.0.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the layered_price_slider parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: prestashop
Affected products: prestashop
CVE-2015-1176 (published 2015-01-23)
Cross-site scripting (XSS) vulnerability in upload/scp/tickets.php in osTicket before 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the status parameter in a search action.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: enhancesoft
Affected products: osticket
CVE-2015-1177 (published 2017-08-28)
Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: exponentcms
Affected products: exponent_cms
CVE-2015-1178 (published 2015-01-26)
Multiple cross-site scripting (XSS) vulnerabilities in cart.php in X-Cart 5.1.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) product_id or (2) category_id parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: qualiteam
Affected products: x-cart
CVE-2015-1179 (published 2015-01-26)
Multiple cross-site scripting (XSS) vulnerabilities in data_point_details.shtm in Mango Automation 2.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dpid, (2) dpxid, or (3) pid parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: infinite_automation_systems
Affected products: mango_automation
CVE-2015-1180 (published 2015-01-23)
Cross-site scripting (XSS) vulnerability in the Web Reports in EventSentry 3.1.0 allows remote attackers to inject arbitrary web script or HTML via the pageId parameter to networktile/bullet.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: eventsentry
Affected products: eventsentry
CVE-2015-1182 (published 2015-01-27)
The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: opensuse, polarssl
Affected products: opensuse, polarssl
CVE-2015-1187 (published 2017-09-21)
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: dlink, trendnet
Affected products: dir-626l, dir-626l_firmware, dir-636l, dir-636l_firmware, dir-651, dir-651_firmware, dir-808l, dir-808l_firmware, dir-810l, dir-810l_firmware, dir-820l, dir-820l_firmware, dir-826l, dir-826l_firmware, dir-830l, dir-830l_firmware, dir-836l, dir-836l_firmware, tew-651br, tew-651br_firmware, tew-652br, tew-652br_firmware, tew-711br, tew-711br_firmware, tew-731br
Added to CISA KEV catalog: 2022-03-25
KEV required action: The impacted product is end-of-life and should be disconnected if still in use.
CVE-2015-1188 (published 2015-05-20)
The certificate verification functions in the HNDS service in Swisscom Centro Grande (ADB) DSL routers with firmware before 6.14.00 allows remote attackers to access the management functions via unknown vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: swisscom
Affected products: centro_grande, centro_grande_firmware
CVE-2015-1191 (published 2015-01-21)
Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-22
Affected vendors: zlib
Affected products: pigz
CVE-2015-1192 (published 2015-01-21)
Absolute path traversal vulnerability in kgb 1.0b4 allows remote attackers to write to arbitrary files via a full pathname in a crafted archive.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-22
Affected vendors: kgb_project
Affected products: kgb
CVE-2015-1193 (published 2015-01-21)
Multiple directory traversal vulnerabilities in pax 1:20140703 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-22
Affected vendors: pax_project
Affected products: pax
CVE-2015-1194 (published 2015-01-21)
pax 1:20140703 allows remote attackers to write to arbitrary files via a symlink attack in an archive.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-59
Affected vendors: pax_project
Affected products: pax
CVE-2015-1195 (published 2015-01-21)
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-22
Affected vendors: openstack
Affected products: image_registry_and_delivery_service_\(glance\)
CVE-2015-1196 (published 2015-01-21)
GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-59
Affected vendors: gnu, opensuse, oracle
Affected products: opensuse, patch, solaris
CVE-2015-1197 (published 2015-02-19)
cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:N/I:P/A:N)
Affected vendors: gnu
Affected products: cpio
CVE-2015-1198 (published 2017-08-28)
Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: linux-ha
Affected products: ha
CVE-2015-1199 (published 2017-08-28)
Directory traversal vulnerability in ppmd 10.1-5.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: ppmd_project
Affected products: ppmd
CVE-2015-1200 (published 2015-01-23)
Race condition in pxz 4.999.99 Beta 3 uses weak file permissions for the output file when compressing a file before changing the permission to match the original file, which allows local users to bypass the intended access restrictions.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-362
Affected vendors: pxz_project
Affected products: pxz
CVE-2015-1201 (published 2015-01-20)
Privoxy before 3.0.22 allows remote attackers to cause a denial of service (file descriptor consumption) via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Affected vendors: privoxy
Affected products: privoxy
CVE-2015-1204 (published 2015-01-21)
Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fs[resource] parameter in the wp-slim-view-2 page to wp-admin/admin.php.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: getusedtoit
Affected products: wp_slimstat
CVE-2015-1205 (published 2015-01-22)
Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.91 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: canonical, chromium, google
Affected products: chrome, chromium, ubuntu_linux
CVE-2015-1206 (published 2017-10-06)
Heap-based buffer overflow in Google Chrome before M40 allows remote attackers to cause a denial of service (unpaged memory write and process crash) via a crafted MP4 file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: google
Affected products: chrome
CVE-2015-1207 (published 2017-06-06)
Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause a denial of service (memory corruption and crash) via a crafted .m4a file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-415
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1208 (published 2018-01-09)
Integer underflow in the mov_read_default function in libavformat/mov.c in FFmpeg before 2.4.6 allows remote attackers to obtain sensitive information from heap and/or stack memory via a crafted MP4 file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-191
Affected vendors: ffmpeg
Affected products: ffmpeg
CVE-2015-1209 (published 2015-02-06)
Use-after-free vulnerability in the VisibleSelection::nonBoundaryShadowTreeRootNode function in core/editing/VisibleSelection.cpp in the DOM implementation in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper handling of a shadow-root anchor.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-416
Affected vendors: apple, canonical, google, linux, microsoft, opensuse, redhat
Affected products: chrome, enterprise_linux_desktop, enterprise_linux_eus, enterprise_linux_server, enterprise_linux_server_aus, enterprise_linux_workstation, linux_kernel, macos, opensuse, ubuntu_linux, windows
CVE-2015-1210 (published 2015-02-06)
The V8ThrowException::createDOMException function in bindings/core/v8/V8ThrowException.cpp in the V8 bindings in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, does not properly consider frame access restrictions during the throwing of an exception, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Affected vendors: apple, canonical, google, linux, microsoft, opensuse, redhat
Affected products: chrome, enterprise_linux_desktop, enterprise_linux_eus, enterprise_linux_server, enterprise_linux_server_aus, enterprise_linux_workstation, linux_kernel, macos, opensuse, ubuntu_linux, windows
CVE-2015-1211 (published 2015-02-06)
The OriginCanAccessServiceWorkers function in content/browser/service_worker/service_worker_dispatcher_host.cc in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android does not properly restrict the URI scheme during a ServiceWorker registration, which allows remote attackers to gain privileges via a filesystem: URI.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: apple, canonical, google, linux, microsoft, opensuse, redhat
Affected products: chrome, enterprise_linux_desktop, enterprise_linux_eus, enterprise_linux_server, enterprise_linux_server_aus, enterprise_linux_workstation, linux_kernel, macos, opensuse, ubuntu_linux, windows
CVE-2015-1212 (published 2015-02-06)
Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: apple, canonical, google, linux, microsoft, opensuse, redhat
Affected products: chrome, enterprise_linux_desktop, enterprise_linux_eus, enterprise_linux_server, enterprise_linux_server_aus, enterprise_linux_workstation, linux_kernel, macos, opensuse, ubuntu_linux, windows
CVE-2015-1213 (published 2015-03-09)
The SkBitmap::ReadRawPixels function in core/SkBitmap.cpp in the filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: google
Affected products: chrome
CVE-2015-1214 (published 2015-03-09)
Integer overflow in the SkAutoSTArray implementation in include/core/SkTemplates.h in the filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a reset action with a large count value, leading to an out-of-bounds write operation.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-190
Affected vendors: canonical, google, redhat
Affected products: chrome, enterprise_linux_desktop_supplementary, enterprise_linux_server_supplementary, enterprise_linux_server_supplementary_eus, enterprise_linux_workstation_supplementary, ubuntu_linux
CVE-2015-1215 (published 2015-03-09)
The filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: canonical, google, redhat
Affected products: chrome, enterprise_linux_desktop_supplementary, enterprise_linux_server_supplementary, enterprise_linux_server_supplementary_eus, enterprise_linux_workstation_supplementary, ubuntu_linux
CVE-2015-1216 (published 2015-03-09)
Use-after-free vulnerability in the V8Window::namedPropertyGetterCustom function in bindings/core/v8/custom/V8WindowCustom.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a frame detachment.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: canonical, google, redhat
Affected products: chrome, enterprise_linux_desktop_supplementary, enterprise_linux_server_supplementary, enterprise_linux_server_supplementary_eus, enterprise_linux_workstation_supplementary, ubuntu_linux
CVE-2015-1217 (published 2015-03-09)
The V8LazyEventListener::prepareListenerObject function in bindings/core/v8/V8LazyEventListener.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, does not properly compile listeners, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-17
Affected vendors: canonical, google, redhat
Affected products: chrome, enterprise_linux_desktop_supplementary, enterprise_linux_server_supplementary, enterprise_linux_server_supplementary_eus, enterprise_linux_workstation_supplementary, ubuntu_linux
CVE-2015-1218 (published 2015-03-09)
Multiple use-after-free vulnerabilities in the DOM implementation in Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger movement of a SCRIPT element to different documents, related to (1) the HTMLScriptElement::didMoveToNewDocument function in core/html/HTMLScriptElement.cpp and (2) the SVGScriptElement::didMoveToNewDocument function in core/svg/SVGScriptElement.cpp.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: canonical, google, redhat
Affected products: chrome, enterprise_linux_desktop_supplementary, enterprise_linux_server_supplementary, enterprise_linux_server_supplementary_eus, enterprise_linux_workstation_supplementary, ubuntu_linux
CVE-2015-1219 (published 2015-03-09)
Integer overflow in the SkMallocPixelRef::NewAllocate function in core/SkMallocPixelRef.cpp in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted allocation of a large amount of memory during WebGL rendering.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-189
Affected vendors: canonical, google, redhat
Affected products: chrome, enterprise_linux_desktop_supplementary, enterprise_linux_server_supplementary, enterprise_linux_server_supplementary_eus, enterprise_linux_workstation_supplementary, ubuntu_linux
CVE-2015-1220 (published 2015-03-09)
Use-after-free vulnerability in the GIFImageReader::parseData function in platform/image-decoders/gif/GIFImageReader.cpp in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted frame size in a GIF image.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Affected vendors: canonical, google, redhat
Affected products: chrome, enterprise_linux_desktop_supplementary, enterprise_linux_server_supplementary, enterprise_linux_server_supplementary_eus, enterprise_linux_workstation_supplementary, ubuntu_linux
CVE-2015-1221 (published 2015-03-09)
Use-after-free vulnerability in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect ordering of operations in the Web SQL Database thread relative to Blink's main thread, related to the shutdown function in web/WebKit.cpp.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: google
Affected products: chrome
CVE-2015-1222 (published 2015-03-09)
Multiple use-after-free vulnerabilities in the ServiceWorkerScriptCacheMap implementation in content/browser/service_worker/service_worker_script_cache_map.cc in Google Chrome before 41.0.2272.76 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a ServiceWorkerContextWrapper::DeleteAndStartOver call, related to the NotifyStartedCaching and NotifyFinishedCaching functions.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: google
Affected products: chrome
CVE-2015-1223 (published 2015-03-09)
Multiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger extraneous change events, as demonstrated by events for invalid input or input to read-only fields, related to the initializeTypeInParsing and updateType functions.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: google
Affected products: chrome
CVE-2015-1224 (published 2015-03-09)
The VpxVideoDecoder::VpxDecode function in media/filters/vpx_video_decoder.cc in the vpxdecoder implementation in Google Chrome before 41.0.2272.76 does not ensure that alpha-plane dimensions are identical to image dimensions, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted VPx video data.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-17
Affected vendors: google
Affected products: chrome
CVE-2015-1225 (published 2015-03-09)
PDFium, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-119
Affected vendors: google
Affected products: chrome
CVE-2015-1226 (published 2015-03-09)
The DebuggerFunction::InitAgentHost function in browser/extensions/api/debugger/debugger_api.cc in Google Chrome before 41.0.2272.76 does not properly restrict what URLs are available as debugger targets, which allows remote attackers to bypass intended access restrictions via a crafted extension.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-264
Affected vendors: google
Affected products: chrome
CVE-2015-1227 (published 2015-03-09)
The DragImage::create function in platform/DragImage.cpp in Blink, as used in Google Chrome before 41.0.2272.76, does not initialize memory for image drawing, which allows remote attackers to have an unspecified impact by triggering a failed image decoding, as demonstrated by an image for which the default orientation cannot be used.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-399
Affected vendors: google
Affected products: chrome
CVE-2015-1228 (published 2015-03-09)
The RenderCounter::updateCounter function in core/rendering/RenderCounter.cpp in Blink, as used in Google Chrome before 41.0.2272.76, does not force a relayout operation and consequently does not initialize memory for a data structure, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted Cascading Style Sheets (CSS) token sequence.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-399
Affected vendors: canonical, google, redhat
Affected products: chrome, enterprise_linux_desktop_supplementary, enterprise_linux_server, enterprise_linux_server_supplementary_eus, enterprise_linux_workstation_supplementary, ubuntu_linux
CVE-2015-1229 (published 2015-03-09)
net/http/proxy_client_socket.cc in Google Chrome before 41.0.2272.76 does not properly handle a 407 (aka Proxy Authentication Required) HTTP status code accompanied by a Set-Cookie header, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-19
Affected vendors: canonical, google, redhat
Affected products: chrome, enterprise_linux_desktop_supplementary, enterprise_linux_server, enterprise_linux_server_supplementary_eus, enterprise_linux_workstation_supplementary, ubuntu_linux
CVE-2015-1230 (published 2015-03-09)
The getHiddenProperty function in bindings/core/v8/V8EventListenerList.h in Blink, as used in Google Chrome before 41.0.2272.76, has a name conflict with the AudioContext class, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via JavaScript code that adds an AudioContext event listener and triggers "type confusion."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: canonical, google, redhat
Affected products: chrome, enterprise_linux_desktop_supplementary, enterprise_linux_server_supplementary, enterprise_linux_server_supplementary_eus, enterprise_linux_workstation_supplementary, ubuntu_linux
CVE-2015-1231 (published 2015-03-09)
Multiple unspecified vulnerabilities in Google Chrome before 41.0.2272.76 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: canonical, google, redhat
Affected products: chrome, enterprise_linux_desktop_supplementary, enterprise_linux_server, enterprise_linux_server_supplementary_eus, enterprise_linux_workstation_supplementary, ubuntu_linux
CVE-2015-1232 (published 2015-03-09)
Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an out-of-bounds write operation, a different vulnerability than CVE-2015-1212.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: google
Affected products: chrome
CVE-2015-1233 (published 2015-04-01)
Google Chrome before 41.0.2272.118 does not properly handle the interaction of IPC, the Gamepad API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-17
Affected vendors: apple, google, linux, microsoft
Affected products: chrome, linux_kernel, macos, windows
CVE-2015-1234 (published 2015-04-01)
Race condition in gpu/command_buffer/service/gles2_cmd_decoder.cc in Google Chrome before 41.0.2272.118 allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact by manipulating OpenGL ES commands.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-362
Affected vendors: apple, google, linux, microsoft
Affected products: chrome, linux_kernel, macos, windows
CVE-2015-1235 (published 2015-04-19)
The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in the HTML parser in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy via a crafted HTML document with an IFRAME element.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-264
Affected vendors: canonical, debian, google
Affected products: chrome, debian_linux, ubuntu_linux
CVE-2015-1236 (published 2015-04-19)
The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a crafted web site containing a media element.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Weakness: CWE-264
Affected vendors: canonical, debian, google
Affected products: chrome, debian_linux, ubuntu_linux
CVE-2015-1237 (published 2015-04-19)
Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in content/renderer/render_frame_impl.cc in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages during a detach operation.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: canonical, debian, google
Affected products: chrome, debian_linux, ubuntu_linux
CVE-2015-1238 (published 2015-04-19)
Skia, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: canonical, debian, google
Affected products: chrome, debian_linux, ubuntu_linux
CVE-2015-1239 (published 2017-10-18)
Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service (process crash) via a crafted PDF.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-415
Affected vendors: debian, google, uclouvain
Affected products: chrome, debian_linux, openjpeg, pdfium
CVE-2015-1240 (published 2015-04-19)
gpu/blink/webgraphicscontext3d_impl.cc in the WebGL implementation in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WebGL program that triggers a state inconsistency.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-119
Affected vendors: canonical, debian, google
Affected products: chrome, debian_linux, ubuntu_linux
CVE-2015-1241 (published 2015-04-19)
Google Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation with the handling of touch events and gesture events, which allows remote attackers to trigger unintended UI actions via a crafted web site that conducts a "tapjacking" attack.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-1021
Affected vendors: canonical, debian, google, opensuse, redhat, suse
Affected products: chrome, debian_linux, enterprise_linux_desktop, enterprise_linux_eus, enterprise_linux_server, enterprise_linux_server_aus, enterprise_linux_server_eus, enterprise_linux_workstation, linux_enterprise, opensuse, ubuntu_linux
CVE-2015-1242 (published 2015-04-19)
The ReduceTransitionElementsKind function in hydrogen-check-elimination.cc in Google V8 before 4.2.77.8, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that leverages "type confusion" in the check-elimination optimization.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: canonical, debian, google
Affected products: chrome, debian_linux, ubuntu_linux, v8
CVE-2015-1243 (published 2015-05-01)
Use-after-free vulnerability in the MutationObserver::disconnect function in core/dom/MutationObserver.cpp in the DOM implementation in Blink, as used in Google Chrome before 42.0.2311.135, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an attempt to unregister a MutationObserver object that is not currently registered.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: canonical, debian, google, redhat
Affected products: chrome, debian_linux, enterprise_linux_desktop_supplementary, enterprise_linux_server_supplementary, enterprise_linux_server_supplementary_eus, enterprise_linux_workstation_supplementary, ubuntu_linux
CVE-2015-1244 (published 2015-04-19)
The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for WebSocket traffic.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: canonical, debian, google
Affected products: chrome, debian_linux, ubuntu_linux
CVE-2015-1245 (published 2015-04-19)
Use-after-free vulnerability in the OpenPDFInReaderView::Update function in browser/ui/views/location_bar/open_pdf_in_reader_view.cc in Google Chrome before 41.0.2272.76 might allow user-assisted remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by triggering interaction with a PDFium "Open PDF in Reader" button that has an invalid tab association.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1246 (published 2015-04-19)
Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-119
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1247 (published 2015-04-19)
The SearchEngineTabHelper::OnPageHasOSDD function in browser/ui/search_engines/search_engine_tab_helper.cc in Google Chrome before 42.0.2311.90 does not prevent use of a file: URL for an OpenSearch descriptor XML document, which might allow remote attackers to obtain sensitive information from local files via a crafted (1) http or (2) https web site.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1248 (published 2015-04-19)
The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the SafeBrowsing for Executable Files protection mechanism by creating a .exe file in a temporary filesystem and then referencing this file with a filesystem:http: URL.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-264
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1249 (published 2015-04-19)
Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.90 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: canonical, debian, google
Affected products: chrome, debian_linux, ubuntu_linux
CVE-2015-1250 (published 2015-05-01)
Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: canonical, debian, google, redhat
Affected products: chrome, debian_linux, enterprise_linux_desktop_supplementary, enterprise_linux_server_supplementary, enterprise_linux_server_supplementary_eus, enterprise_linux_workstation_supplementary, ubuntu_linux
CVE-2015-1251 (published 2015-05-20)
Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem in Google Chrome before 43.0.2357.65 allows remote attackers to execute arbitrary code via a crafted document.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1252 (published 2015-05-20)
common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1253 (published 2015-05-20)
core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-284
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1254 (published 2015-05-20)
core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-264
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1255 (published 2015-05-20)
Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation in Google Chrome before 43.0.2357.65 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging improper handling of a stop action for an audio track.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1256 (published 2015-05-20)
Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that leverages improper handling of a shadow tree for a use element.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1257 (published 2015-05-20)
platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (container overflow) or possibly have unspecified other impact via a crafted document.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1258 (published 2015-05-20)
Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, which allows remote attackers to trigger a negative value for a size field, and consequently cause a denial of service or possibly have unspecified other impact, via a crafted frame size in VP9 video data.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-189
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1259 (published 2015-05-20)
PDFium, as used in Google Chrome before 43.0.2357.65, does not properly initialize memory, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-17
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1260 (published 2015-05-20)
Multiple use-after-free vulnerabilities in content/renderer/media/user_media_client_impl.cc in the WebRTC implementation in Google Chrome before 43.0.2357.65 allow remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that executes upon completion of a getUserMedia request.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1261 (published 2015-05-20)
android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or deliver misleading popup content via crafted text.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-20
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1262 (published 2015-05-20)
platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width field, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Unicode text.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-17
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1263 (published 2015-05-20)
The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-17
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1264 (published 2015-05-20)
Cross-site scripting (XSS) vulnerability in Google Chrome before 43.0.2357.65 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted data that is improperly handled by the Bookmarks feature.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1265 (published 2015-05-20)
Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: debian, google
Affected products: chrome, debian_linux
CVE-2015-1266 (published 2015-06-26)
content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated with a WebUI SiteInstance, which allows remote attackers to bypass intended access restrictions via a similar URL, as demonstrated by use of http://gpu when there is a WebUI class for handling chrome://gpu requests.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-254
Affected vendors: google
Affected products: chrome
CVE-2015-1267 (published 2015-06-26)
Blink, as used in Google Chrome before 43.0.2357.130, does not properly restrict the creation context during creation of a DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that uses a Blink public API, related to WebArrayBufferConverter.cpp, WebBlob.cpp, WebDOMError.cpp, and WebDOMFileSystem.cpp.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-254
Affected vendors: google
Affected products: chrome
CVE-2015-1268 (published 2015-06-26)
bindings/scripts/v8_types.py in Blink, as used in Google Chrome before 43.0.2357.130, does not properly select a creation context for a return value's DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code, as demonstrated by use of a data: URL.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-254
Affected vendors: google
Affected products: chrome
CVE-2015-1269 (published 2015-06-26)
The DecodeHSTSPreloadRaw function in net/http/transport_security_state.cc in Google Chrome before 43.0.2357.130 does not properly canonicalize DNS hostnames before making comparisons to HSTS or HPKP preload entries, which allows remote attackers to bypass intended access restrictions via a string that (1) ends in a . (dot) character or (2) is not entirely lowercase.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-254
Affected vendors: google
Affected products: chrome