deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-1358
Published: 2016-03-03
Description: Cisco Prime Infrastructure 2.2, 3.0, and 3.1(0.0) allows remote authenticated users to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCuw81497.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-cpi; http://www.securitytracker.com/id/1035181; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-cpi
CVE: CVE-2016-1359
Published: 2016-03-03
Description: Cisco Prime Infrastructure 3.0 allows remote authenticated users to execute arbitrary code via a crafted HTTP request that is mishandled during viewing of a log file, aka Bug ID CSCuw81494.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-cpi1; http://www.securitytracker.com/id/1035186; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-cpi1
CVE: CVE-2016-2243
Published: 2016-03-04
Description: Sure Start on HP Commercial PCs 2015 allows local users to cause a denial of service (BIOS recovery failure) by leveraging administrative access.
CVSS Score: 7.9 (HIGH)
CWE: CWE-284
References: http://www.securitytracker.com/id/1035193; https://h20565.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c05012469; http://www.securitytracker.com/id/1035193
CVE: CVE-2016-2244
Published: 2016-03-04
Description: HP LaserJet printers and MFPs and OfficeJet Enterprise printers with firmware before 3.7.01 allow remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1035191; https://h20565.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c05030353; http://www.securitytracker.com/id/1035191
CVE: CVE-2016-2282
Published: 2016-03-04
Description: Moxa ioLogik E2200 devices before 3.12 and ioAdmin Configuration Utility before 3.18 do not properly encrypt credentials, which makes it easier for remote attackers to obtain the associated cleartext via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-255
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-063-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-063-01
CVE: CVE-2016-2283
Published: 2016-03-04
Description: Moxa ioLogik E2200 devices before 3.12 and ioAdmin Configuration Utility before 3.18 do not properly encrypt data, which makes it easier for remote attackers to obtain the associated cleartext via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-255
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-063-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-063-01
CVE: CVE-2015-8652
Published: 2016-03-04
Description: Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, CVE-2015-8455, CVE-2015-8654, CVE-2015-8656, CVE-2015-8657, CVE-2015-8658, and CVE-2015-8820.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/84160; http://www.zerodayinitiative.com/advisories/ZDI-15-656; https://helpx.adobe.com/security/products/flash-player/apsb15-32.html
CVE: CVE-2015-8653
Published: 2016-03-04
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted MPEG-4 data, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, CVE-2015-8454, CVE-2015-8655, CVE-2015-8821, and CVE-2015-8822.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/84162; http://www.zerodayinitiative.com/advisories/ZDI-15-657; https://helpx.adobe.com/security/products/flash-player/apsb15-32.html
CVE: CVE-2015-8654
Published: 2016-03-04
Description: Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, CVE-2015-8455, CVE-2015-8652, CVE-2015-8656, CVE-2015-8657, CVE-2015-8658, and CVE-2015-8820.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/84160; http://www.zerodayinitiative.com/advisories/ZDI-15-658; https://helpx.adobe.com/security/products/flash-player/apsb15-32.html
CVE: CVE-2015-8655
Published: 2016-03-04
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted MPEG-4 data, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, CVE-2015-8454, CVE-2015-8653, CVE-2015-8821, and CVE-2015-8822.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/84162; http://www.zerodayinitiative.com/advisories/ZDI-15-655; https://helpx.adobe.com/security/products/flash-player/apsb15-32.html
CVE: CVE-2015-8656
Published: 2016-03-04
Description: Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, CVE-2015-8455, CVE-2015-8652, CVE-2015-8654, CVE-2015-8657, CVE-2015-8658, and CVE-2015-8820.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/84160; http://www.zerodayinitiative.com/advisories/ZDI-15-659; https://helpx.adobe.com/security/products/flash-player/apsb15-32.html
CVE: CVE-2015-8657
Published: 2016-03-04
Description: Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, CVE-2015-8455, CVE-2015-8652, CVE-2015-8654, CVE-2015-8656, CVE-2015-8658, and CVE-2015-8820.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/84160; http://www.zerodayinitiative.com/advisories/ZDI-15-660; https://helpx.adobe.com/security/products/flash-player/apsb15-32.html
CVE: CVE-2015-8658
Published: 2016-03-04
Description: Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (uninitialized pointer dereference and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, CVE-2015-8455, CVE-2015-8652, CVE-2015-8654, CVE-2015-8656, CVE-2015-8657, and CVE-2015-8820.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/84160; http://www.zerodayinitiative.com/advisories/ZDI-15-662; https://helpx.adobe.com/security/products/flash-player/apsb15-32.html
CVE: CVE-2015-8820
Published: 2016-03-04
Description: Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, CVE-2015-8455, CVE-2015-8652, CVE-2015-8654, CVE-2015-8656, CVE-2015-8657, and CVE-2015-8658.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/84160; http://www.zerodayinitiative.com/advisories/ZDI-15-661; https://helpx.adobe.com/security/products/flash-player/apsb15-32.html
CVE: CVE-2015-8821
Published: 2016-03-04
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted MPEG-4 data, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, CVE-2015-8454, CVE-2015-8653, CVE-2015-8655, and CVE-2015-8822.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/84162; http://www.zerodayinitiative.com/advisories/ZDI-15-663; https://helpx.adobe.com/security/products/flash-player/apsb15-32.html
CVE: CVE-2015-8822
Published: 2016-03-04
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted MPEG-4 data, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, CVE-2015-8454, CVE-2015-8653, CVE-2015-8655, and CVE-2015-8821.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.zerodayinitiative.com/advisories/ZDI-15-664; https://helpx.adobe.com/security/products/flash-player/apsb15-32.html; http://www.zerodayinitiative.com/advisories/ZDI-15-664
CVE: CVE-2016-1630
Published: 2016-03-06
Description: The ContainerNode::parserRemoveChild function in WebKit/Source/core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 49.0.2623.75, mishandles widget updates, which makes it easier for remote attackers to bypass the Same Origin Policy via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html
CVE: CVE-2016-1631
Published: 2016-03-06
Description: The PPB_Flash_MessageLoop_Impl::InternalRun function in content/renderer/pepper/ppb_flash_message_loop_impl.cc in the Pepper plugin in Google Chrome before 49.0.2623.75 mishandles nested message loops, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html
CVE: CVE-2016-1632
Published: 2016-03-06
Description: The Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly maintain own properties, which allows remote attackers to bypass intended access restrictions via crafted JavaScript code that triggers an incorrect cast, related to extensions/renderer/v8_helpers.h and gin/converter.h.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html
CVE: CVE-2016-1633
Published: 2016-03-06
Description: Use-after-free vulnerability in Blink, as used in Google Chrome before 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html
CVE: CVE-2016-1634
Published: 2016-03-06
Description: Use-after-free vulnerability in the StyleResolver::appendCSSStyleSheet function in WebKit/Source/core/css/resolver/StyleResolver.cpp in Blink, as used in Google Chrome before 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site that triggers Cascading Style Sheets (CSS) style invalidation during a certain subtree-removal action.
CVSS Score: 8.8 (HIGH)
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html
CVE: CVE-2016-1635
Published: 2016-03-06
Description: extensions/renderer/render_frame_observer_natives.cc in Google Chrome before 49.0.2623.75 does not properly consider object lifetimes and re-entrancy issues during OnDocumentElementCreated handling, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html
CVE: CVE-2016-1636
Published: 2016-03-06
Description: The PendingScript::notifyFinished function in WebKit/Source/core/dom/PendingScript.cpp in Google Chrome before 49.0.2623.75 relies on memory-cache information about integrity-check occurrences instead of integrity-check successes, which allows remote attackers to bypass the Subresource Integrity (aka SRI) protection mechanism by triggering two loads of the same resource.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html
CVE: CVE-2016-1637
Published: 2016-03-06
Description: The SkATan2_255 function in effects/gradients/SkSweepGradient.cpp in Skia, as used in Google Chrome before 49.0.2623.75, mishandles arctangent calculations, which allows remote attackers to obtain sensitive information via a crafted web site.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html
CVE: CVE-2016-1638
Published: 2016-03-06
Description: extensions/renderer/resources/platform_app.js in the Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly restrict use of Web APIs, which allows remote attackers to bypass intended access restrictions via a crafted platform app.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html
CVE: CVE-2016-1639
Published: 2016-03-06
Description: Use-after-free vulnerability in browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc in the WebRTC Audio Private API implementation in Google Chrome before 49.0.2623.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect reliance on the resource context pointer.
CVSS Score: 9.8 (CRITICAL)
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html
CVE: CVE-2016-1640
Published: 2016-03-06
Description: The Web Store inline-installer implementation in the Extensions UI in Google Chrome before 49.0.2623.75 does not block installations upon deletion of an installation frame, which makes it easier for remote attackers to trick a user into believing that an installation request originated from the user's next navigation target via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-17
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html
CVE: CVE-2016-1641
Published: 2016-03-06
Description: Use-after-free vulnerability in content/browser/web_contents/web_contents_impl.cc in Google Chrome before 49.0.2623.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an image download after a certain data structure is deleted, as demonstrated by a favicon.ico download.
CVSS Score: 8.8 (HIGH)
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html
CVE: CVE-2016-1642
Published: 2016-03-06
Description: Multiple unspecified vulnerabilities in Google Chrome before 49.0.2623.75 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html
CVE: CVE-2016-2843
Published: 2016-03-06
Description: Multiple unspecified vulnerabilities in Google V8 before 4.9.385.26, as used in Google Chrome before 49.0.2623.75, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html; http://www.securitytracker.com/id/1035185; http://www.ubuntu.com/usn/USN-2920-1
CVE: CVE-2016-2844
Published: 2016-03-06
Description: WebKit/Source/core/layout/LayoutBlock.cpp in Blink, as used in Google Chrome before 49.0.2623.75, does not properly determine when anonymous block wrappers may exist, which allows remote attackers to cause a denial of service (incorrect cast and assertion failure) or possibly have unspecified other impact via crafted JavaScript code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html; http://www.securityfocus.com/bid/84170; http://www.securitytracker.com/id/1035185
CVE: CVE-2016-2845
Published: 2016-03-06
Description: The Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 49.0.2623.75, does not ignore a URL's path component in the case of a ServiceWorker fetch, which allows remote attackers to obtain sensitive information about visited web pages by reading CSP violation reports, related to FrameFetchContext.cpp and ResourceFetcher.cpp.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html; http://homakov.blogspot.com/2014/01/using-content-security-policy-for-evil.html; http://www.securityfocus.com/bid/84168