rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-1619 
Multiple integer overflows in the (1) sycc422_to_rgb and (2) sycc444_to_rgb functions in fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium, as used in Google Chrome before 48.0.2564.82, allow remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-25T11:00:00.000Z
CVE-2016-1620 
Multiple unspecified vulnerabilities in Google Chrome before 48.0.2564.82 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-25T11:00:00.000Z
CVE-2016-1621 
libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to libwebm/mkvparser.cpp and other files, aka internal bug 23452792.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-12T21:00:00.000Z
CVE-2016-1622 
The Extensions subsystem in Google Chrome before 48.0.2564.109 does not prevent use of the Object.defineProperty method to override intended extension behavior, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-14T02:00:00.000Z
CVE-2016-1623 
The DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to FrameLoader.cpp, HTMLFrameOwnerElement.h, LocalFrame.cpp, and WebLocalFrameImpl.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-14T02:00:00.000Z
CVE-2016-1624 
Integer underflow in the ProcessCommandsInternal function in dec/decode.c in Brotli, as used in Google Chrome before 48.0.2564.109, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted data with brotli compression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-14T02:00:00.000Z
CVE-2016-1625 
The Chrome Instant feature in Google Chrome before 48.0.2564.109 does not ensure that a New Tab Page (NTP) navigation target is on the most-visited or suggestions list, which allows remote attackers to bypass intended restrictions via unspecified vectors, related to instant_service.cc and search_tab_helper.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-14T02:00:00.000Z
CVE-2016-1626 
The opj_pi_update_decode_poc function in pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, miscalculates a certain layer index value, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-14T02:00:00.000Z
CVE-2016-1627 
The Developer Tools (aka DevTools) subsystem in Google Chrome before 48.0.2564.109 does not validate URL schemes and ensure that the remoteBase parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to bypass intended access restrictions via a crafted URL, related to browser/devtools/devtools_ui_bindings.cc and WebKit/Source/devtools/front_end/Runtime.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-14T02:00:00.000Z
CVE-2016-1628 
pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, does not validate a certain precision value, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted JPEG 2000 image in a PDF document, related to the opj_pi_next_rpcl, opj_pi_next_pcrl, and opj_pi_next_cprl functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-21T02:00:00.000Z
CVE-2016-1629 
Google Chrome before 48.0.2564.116 allows remote attackers to bypass the Blink Same Origin Policy and a sandbox protection mechanism via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-21T18:00:00.000Z
CVE-2016-1630 
The ContainerNode::parserRemoveChild function in WebKit/Source/core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 49.0.2623.75, mishandles widget updates, which makes it easier for remote attackers to bypass the Same Origin Policy via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-06T02:00:00.000Z
CVE-2016-1631 
The PPB_Flash_MessageLoop_Impl::InternalRun function in content/renderer/pepper/ppb_flash_message_loop_impl.cc in the Pepper plugin in Google Chrome before 49.0.2623.75 mishandles nested message loops, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-06T02:00:00.000Z
CVE-2016-1632 
The Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly maintain own properties, which allows remote attackers to bypass intended access restrictions via crafted JavaScript code that triggers an incorrect cast, related to extensions/renderer/v8_helpers.h and gin/converter.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-06T02:00:00.000Z
CVE-2016-1633 
Use-after-free vulnerability in Blink, as used in Google Chrome before 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-06T02:00:00.000Z
CVE-2016-1634 
Use-after-free vulnerability in the StyleResolver::appendCSSStyleSheet function in WebKit/Source/core/css/resolver/StyleResolver.cpp in Blink, as used in Google Chrome before 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site that triggers Cascading Style Sheets (CSS) style invalidation during a certain subtree-removal action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-06T02:00:00.000Z
CVE-2016-1635 
extensions/renderer/render_frame_observer_natives.cc in Google Chrome before 49.0.2623.75 does not properly consider object lifetimes and re-entrancy issues during OnDocumentElementCreated handling, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-06T02:00:00.000Z
CVE-2016-1636 
The PendingScript::notifyFinished function in WebKit/Source/core/dom/PendingScript.cpp in Google Chrome before 49.0.2623.75 relies on memory-cache information about integrity-check occurrences instead of integrity-check successes, which allows remote attackers to bypass the Subresource Integrity (aka SRI) protection mechanism by triggering two loads of the same resource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-06T02:00:00.000Z
CVE-2016-1637 
The SkATan2_255 function in effects/gradients/SkSweepGradient.cpp in Skia, as used in Google Chrome before 49.0.2623.75, mishandles arctangent calculations, which allows remote attackers to obtain sensitive information via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-06T02:00:00.000Z
CVE-2016-1638 
extensions/renderer/resources/platform_app.js in the Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly restrict use of Web APIs, which allows remote attackers to bypass intended access restrictions via a crafted platform app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-06T02:00:00.000Z
CVE-2016-1639 
Use-after-free vulnerability in browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc in the WebRTC Audio Private API implementation in Google Chrome before 49.0.2623.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect reliance on the resource context pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-06T02:00:00.000Z
CVE-2016-1640 
The Web Store inline-installer implementation in the Extensions UI in Google Chrome before 49.0.2623.75 does not block installations upon deletion of an installation frame, which makes it easier for remote attackers to trick a user into believing that an installation request originated from the user's next navigation target via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-06T02:00:00.000Z
CVE-2016-1641 
Use-after-free vulnerability in content/browser/web_contents/web_contents_impl.cc in Google Chrome before 49.0.2623.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an image download after a certain data structure is deleted, as demonstrated by a favicon.ico download.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-06T02:00:00.000Z
CVE-2016-1642 
Multiple unspecified vulnerabilities in Google Chrome before 49.0.2623.75 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-06T02:00:00.000Z
CVE-2016-1643 
The ImageInputType::ensurePrimaryContent function in WebKit/Source/core/html/forms/ImageInputType.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly maintain the user agent shadow DOM, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-13T22:00:00.000Z
CVE-2016-1644 
WebKit/Source/core/layout/LayoutObject.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly restrict relayout scheduling, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-13T22:00:00.000Z
CVE-2016-1645 
Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 49.0.2623.87, allow remote attackers to cause a denial of service (incorrect cast and out-of-bounds write) or possibly have unspecified other impact via crafted JPEG 2000 data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-13T22:00:00.000Z
CVE-2016-1646 
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-29T10:00:00.000Z
CVE-2016-1647 
Use-after-free vulnerability in the RenderWidgetHostImpl::Destroy function in content/browser/renderer_host/render_widget_host_impl.cc in the Navigation implementation in Google Chrome before 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-29T10:00:00.000Z
CVE-2016-1648 
Use-after-free vulnerability in the GetLoadTimes function in renderer/loadtimes_extension_bindings.cc in the Extensions implementation in Google Chrome before 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-29T10:00:00.000Z
CVE-2016-1649 
The Program::getUniformInternal function in Program.cpp in libANGLE, as used in Google Chrome before 49.0.2623.108, does not properly handle a certain data-type mismatch, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted shader stages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-29T10:00:00.000Z
CVE-2016-1650 
The PageCaptureSaveAsMHTMLFunction::ReturnFailure function in browser/extensions/api/page_capture/page_capture_api.cc in Google Chrome before 49.0.2623.108 allows attackers to cause a denial of service or possibly have unspecified other impact by triggering an error in creating an MHTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-29T10:00:00.000Z
CVE-2016-1651 
fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium, as used in Google Chrome before 50.0.2661.75, does not properly implement the sycc420_to_rgb and sycc422_to_rgb functions, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via crafted JPEG 2000 data in a PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T10:00:00.000Z
CVE-2016-1652 
Cross-site scripting (XSS) vulnerability in the ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the Extensions subsystem in Google Chrome before 50.0.2661.75 allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T10:00:00.000Z
CVE-2016-1653 
The LoadBuffer implementation in Google V8, as used in Google Chrome before 50.0.2661.75, mishandles data types, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers an out-of-bounds write operation, related to compiler/pipeline.cc and compiler/simplified-lowering.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T10:00:00.000Z
CVE-2016-1654 
The media subsystem in Google Chrome before 50.0.2661.75 does not initialize an unspecified data structure, which allows remote attackers to cause a denial of service (invalid read operation) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T10:00:00.000Z
CVE-2016-1655 
Google Chrome before 50.0.2661.75 does not properly consider that frame removal may occur during callback execution, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T10:00:00.000Z
CVE-2016-1656 
The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T10:00:00.000Z
CVE-2016-1657 
The WebContentsImpl::FocusLocationBarByDefault function in content/browser/web_contents/web_contents_impl.cc in Google Chrome before 50.0.2661.75 mishandles focus for certain about:blank pages, which allows remote attackers to spoof the address bar via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T10:00:00.000Z
CVE-2016-1658 
The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin comparisons, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T10:00:00.000Z
CVE-2016-1659 
Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.75 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T10:00:00.000Z
CVE-2016-1660 
Blink, as used in Google Chrome before 50.0.2661.94, mishandles assertions in the WTF::BitArray and WTF::double_conversion::Vector classes, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-14T21:00:00.000Z
CVE-2016-1661 
Blink, as used in Google Chrome before 50.0.2661.94, does not ensure that frames satisfy a check for the same renderer process in addition to a Same Origin Policy check, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted web site, related to BindingSecurity.cpp and DOMWindow.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-14T21:00:00.000Z
CVE-2016-1662 
extensions/renderer/gc_callback.cc in Google Chrome before 50.0.2661.94 does not prevent fallback execution once the Garbage Collection callback has started, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-14T21:00:00.000Z
CVE-2016-1663 
The SerializedScriptValue::transferArrayBuffers function in WebKit/Source/bindings/core/v8/SerializedScriptValue.cpp in the V8 bindings in Blink, as used in Google Chrome before 50.0.2661.94, mishandles certain array-buffer data structures, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-14T21:00:00.000Z
CVE-2016-1664 
The HistoryController::UpdateForCommit function in content/renderer/history_controller.cc in Google Chrome before 50.0.2661.94 mishandles the interaction between subframe forward navigations and other forward navigations, which allows remote attackers to spoof the address bar via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-14T21:00:00.000Z
CVE-2016-1665 
The JSGenericLowering class in compiler/js-generic-lowering.cc in Google V8, as used in Google Chrome before 50.0.2661.94, mishandles comparison operators, which allows remote attackers to obtain sensitive information via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-14T21:00:00.000Z
CVE-2016-1666 
Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.94 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-14T21:00:00.000Z
CVE-2016-1667 
The TreeScope::adoptIfNeeded function in WebKit/Source/core/dom/TreeScope.cpp in the DOM implementation in Blink, as used in Google Chrome before 50.0.2661.102, does not prevent script execution during node-adoption operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-14T21:00:00.000Z
CVE-2016-1668 
The forEachForBinding function in WebKit/Source/bindings/core/v8/Iterable.h in the V8 bindings in Blink, as used in Google Chrome before 50.0.2661.102, uses an improper creation context, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-14T21:00:00.000Z
CVE-2016-1669 
The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-14T21:00:00.000Z
CVE-2016-1670 
Race condition in the ResourceDispatcherHostImpl::BeginRequest function in content/browser/loader/resource_dispatcher_host_impl.cc in Google Chrome before 50.0.2661.102 allows remote attackers to make arbitrary HTTP requests by leveraging access to a renderer process and reusing a request ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-14T21:00:00.000Z
CVE-2016-1671 
Google Chrome before 50.0.2661.102 on Android mishandles / (slash) and \ (backslash) characters, which allows attackers to conduct directory traversal attacks via a file: URL, related to net/base/escape.cc and net/base/filename_util.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-14T21:00:00.000Z
CVE-2016-1672 
The ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the extension bindings in Google Chrome before 51.0.2704.63 mishandles properties, which allows remote attackers to conduct bindings-interception attacks and bypass the Same Origin Policy via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-05T23:00:00.000Z
CVE-2016-1673 
Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-05T23:00:00.000Z
CVE-2016-1674 
The extensions subsystem in Google Chrome before 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-05T23:00:00.000Z
CVE-2016-1675 
Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy by leveraging the mishandling of Document reattachment during destruction, related to FrameLoader.cpp and LocalFrame.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-05T23:00:00.000Z
CVE-2016-1676 
extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.63 does not properly use prototypes, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-05T23:00:00.000Z
CVE-2016-1677 
uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain sensitive information by calling the decodeURI function and leveraging "type confusion."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-05T23:00:00.000Z