deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-33465
Published: 2022-07-26
Description: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmacro() in modules/preprocs/nasm/nasm-pp.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/yasm/yasm/issues/173; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33466
Published: 2022-07-26
Description: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_smacro() in modules/preprocs/nasm/nasm-pp.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/yasm/yasm/issues/172; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33467
Published: 2022-07-26
Description: An issue was discovered in yasm version 1.3.0. There is a use-after-free in pp_getline() in modules/preprocs/nasm/nasm-pp.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/yasm/yasm/issues/163; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33468
Published: 2022-07-26
Description: An issue was discovered in yasm version 1.3.0. There is a use-after-free in error() in modules/preprocs/nasm/nasm-pp.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/yasm/yasm/issues/162; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2022-31879
Published: 2022-07-26
Description: Online Fire Reporting System 1.0 is vulnerable to SQL Injection via the date parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Online-Fire-Reporting; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Online-Fire-Reporting
CVE: CVE-2022-33745
Published: 2022-07-26
Description: insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. To address XSA-401, code was moved inside a function in Xen. This code movement missed a variable changing meaning / value between old and new code positions. The now wrong use of the variable did lead to a wrong TLB flush condition, omitting flushes where such are necessary.
CVSS Score: 8.8 (HIGH)
References: http://www.openwall.com/lists/oss-security/2022/07/26/2; http://www.openwall.com/lists/oss-security/2022/07/26/3; http://xenbits.xen.org/xsa/advisory-408.html
CVE: CVE-2022-34067
Published: 2022-07-26
Description: Warehouse Management System v1.0 was discovered to contain a SQL injection vulnerability via the cari parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Warehouse-Management-System; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Warehouse-Management-System
CVE: CVE-2022-34988
Published: 2022-07-26
Description: Inout Blockchain AltExchanger v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/js.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Inout-Blockchain-AltExchanger/2022/Cross-site-scripting-DOM-based-IG-js; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Inout-Blockchain-AltExchanger/2022/Cross-site-scripting-DOM-based-IG-js
CVE: CVE-2022-34989
Published: 2022-07-26
Description: Fruits Bazar v1.0 was discovered to contain a SQL injection vulnerability via the recover_email parameter at user_password_recover.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Md-Saiful-Islam-creativesaiful/2021/Ecommerce-project-with-php-and-mysqli-Fruits-Bazar; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Md-Saiful-Islam-creativesaiful/2021/Ecommerce-project-with-php-and-mysqli-Fruits-Bazar
CVE: CVE-2022-34991
Published: 2022-07-26
Description: Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the first_name and last_name parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/paymoney/2022/paymoney-3.3; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/paymoney/2022/paymoney-3.3
CVE: CVE-2022-36161
Published: 2022-07-26
Description: Orange Station 1.0 was discovered to contain a SQL injection vulnerability via the username parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/Orange-Station-1.0; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/Orange-Station-1.0
CVE: CVE-2022-36412
Published: 2022-07-26
Description: In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. (An API request may, in effect, be executed with the credentials of a user who authenticated in the past.)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.manageengine.com/products/support-center/cve-2022-36412.html; https://www.manageengine.com/products/support-center/cve-2022-36412.html
CVE: CVE-2022-1648
Published: 2022-07-26
Description: Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images directory which is restricted to execute the .php file. The impact could lead to a Remote Code Execution with running application privilege.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://www.incibe.es/en/cve-assignment-publication/coordinated-cves; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2022-22412
Published: 2022-07-26
Description: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with access to the local host (client machine) to obtain a login access token. IBM X-Force ID: 223019.
CVSS Score: 4.6 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/223019; https://www.ibm.com/support/pages/node/6607045; https://exchange.xforce.ibmcloud.com/vulnerabilities/223019
CVE: CVE-2022-35286
Published: 2022-07-26
Description: IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 230814.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/230814; https://www.ibm.com/support/pages/node/6607057; https://exchange.xforce.ibmcloud.com/vulnerabilities/230814
CVE: CVE-2022-35639
Published: 2022-07-26
Description: IBM Sterling Partner Engagement Manager 6.1, 6.2, and Cloud 22.2 do not limit the length of a connection which could cause the server to become unresponsive. IBM X-Force ID: 230932.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/230932; https://www.ibm.com/support/pages/node/6606969; https://exchange.xforce.ibmcloud.com/vulnerabilities/230932
CVE: CVE-2022-1651
Published: 2022-07-26
Description: A memory leak flaw was found in the Linux kernel in acrn_dev_ioctl in the drivers/virt/acrn/hsm.c function in how the ACRN Device Model emulates virtual NICs in VM. This flaw allows a local privileged attacker to leak unauthorized kernel information, causing a denial of service.
CVSS Score: 7.1 (HIGH)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ecd1735f14d6ac868ae5d8b7a2bf193fa11f388b; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ecd1735f14d6ac868ae5d8b7a2bf193fa11f388b
CVE: CVE-2022-1671
Published: 2022-07-26
Description: A NULL pointer dereference flaw was found in rxrpc_preparse_s in net/rxrpc/server_key.c in the Linux kernel. This flaw allows a local attacker to crash the system or leak internal kernel information.
CVSS Score: 7.1 (HIGH)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ff8376ade4f[PII_REDACTED]39cef586a0990f8ef87; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-1364
Published: 2022-07-26
Description: Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_14.html; https://crbug.com/1315901; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1477
Published: 2022-07-26
Description: Use after free in Vulkan in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1313905; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1478
Published: 2022-07-26
Description: Use after free in SwiftShader in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1299261; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1479
Published: 2022-07-26
Description: Use after free in ANGLE in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1305190; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1481
Published: 2022-07-26
Description: Use after free in Sharing in Google Chrome on Mac prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1302949; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1482
Published: 2022-07-26
Description: Inappropriate implementation in WebGL in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1304987; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1483
Published: 2022-07-26
Description: Heap buffer overflow in WebGPU in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1314754; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1484
Published: 2022-07-26
Description: Heap buffer overflow in Web UI Settings in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1297429; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1485
Published: 2022-07-26
Description: Use after free in File System API in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1299743; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1486
Published: 2022-07-26
Description: Type confusion in V8 in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1314616; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1487
Published: 2022-07-26
Description: Use after free in Ozone in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via running a Wayland test.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1304368; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1488
Published: 2022-07-26
Description: Inappropriate implementation in Extensions API in Google Chrome prior to 101.0.4951.41 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-668
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1302959; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1489
Published: 2022-07-26
Description: Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific user interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1300561; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1490
Published: 2022-07-26
Description: Use after free in Browser Switcher in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1301840; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1491
Published: 2022-07-26
Description: Use after free in Bookmarks in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1305706; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1492
Published: 2022-07-26
Description: Insufficient data validation in Blink Editing in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1315040; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1493
Published: 2022-07-26
Description: Use after free in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1275414; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1494
Published: 2022-07-26
Description: Insufficient data validation in Trusted Types in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass trusted types policy via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1298122; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1495
Published: 2022-07-26
Description: Incorrect security UI in Downloads in Google Chrome on Android prior to 101.0.4951.41 allowed a remote attacker to spoof the APK downloads dialog via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1301180; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1496
Published: 2022-07-26
Description: Use after free in File Manager in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1306391; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1497
Published: 2022-07-26
Description: Inappropriate implementation in Input in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to spoof the contents of cross-origin websites via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1264543; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1498
Published: 2022-07-26
Description: Inappropriate implementation in HTML Parser in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-668
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1297138; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1499
Published: 2022-07-26
Description: Inappropriate implementation in WebAuthentication in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-863
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1000408; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1500
Published: 2022-07-26
Description: Insufficient data validation in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1223475; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1501
Published: 2022-07-26
Description: Inappropriate implementation in iframe in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1293191; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1633
Published: 2022-07-26
Description: Use after free in Sharesheet in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html; https://crbug.com/1316990; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1634
Published: 2022-07-26
Description: Use after free in Browser UI in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who had convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific user interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html; https://crbug.com/1314908; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1635
Published: 2022-07-26
Description: Use after free in Permission Prompts in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html; https://crbug.com/1319797; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1636
Published: 2022-07-26
Description: Use after free in Performance APIs in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html; https://crbug.com/1297283; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1637
Published: 2022-07-26
Description: Inappropriate implementation in Web Contents in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-668
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html; https://crbug.com/1311820; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1638
Published: 2022-07-26
Description: Heap buffer overflow in V8 Internationalization in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html; https://crbug.com/1316946; https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html
CVE: CVE-2022-1639
Published: 2022-07-26
Description: Use after free in ANGLE in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html; https://crbug.com/1317650; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1640
Published: 2022-07-26
Description: Use after free in Sharing in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html; https://crbug.com/1320592; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1641
Published: 2022-07-26
Description: Use after free in Web UI Diagnostics in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html; https://crbug.com/1305068; https://security.gentoo.org/glsa/202208-25