CVE-2017-2930

flash-plugin: multiple code execution issues fixed in APSB17-02

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability due to a concurrency error when manipulating a display list. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 25.1% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Mac Os X Chrome Os and 5 more

CVE-2017-2931

flash-plugin: multiple code execution issues fixed in APSB17-02

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to the parsing of SWF metadata. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 21.1% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Mac Os X Chrome Os and 5 more

CVE-2017-2932

flash-plugin: multiple code execution issues fixed in APSB17-02

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript MovieClip class. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 24.6% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Mac Os X Chrome Os and 5 more

CVE-2017-2994

flash-plugin: multiple code execution issues fixed in APSB17-07

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in Primetime SDK event dispatch. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 6.3% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2017-2995

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable type confusion vulnerability related to the MessageChannel class. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 6.4% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2017-2996

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in Primetime SDK. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 4.9% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2017-5035

chromium-browser: incorrect security ui in omnibox

Google Chrome prior to 57.0.2987.98 for Windows and Mac had a race condition, which could cause Chrome to display incorrect certificate information for a site.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apple Debian Google and 2 more

Products

Macos Debian Linux Chrome and 5 more

CVE-2017-2997

flash-plugin: multiple code execution issues fixed in APSB17-07

Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable buffer overflow / underflow vulnerability in the Primetime TVSDK that supports customizing ad information. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 7.4% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2017-2998

flash-plugin: multiple code execution issues fixed in APSB17-07

Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK API functionality related to timeline interactions. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 4.1% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2017-5052

chromium-browser: bad cast in blink

An incorrect assumption about block structure in Blink in Google Chrome prior to 57.0.2987.133 for Mac, Windows, and Linux, and 57.0.2987.132 for Android, allowed a remote attacker to potentially exploit memory corruption via a crafted HTML page that triggers improper casting.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5053

chromium-browser: out of bounds memory access in v8

An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to Array.prototype.indexOf.

CVSS 3.1 · 9.6 Critical EPSS 2.6% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5054

chromium-browser: heap buffer overflow in v8

An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to obtain heap memory contents via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5056

chromium-browser: use after free in blink

A use after free in Blink in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5057

chromium-browser: type confusion in pdfium

Type confusion in PDFium in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5059

chromium-browser: type confusion in blink

Type confusion in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to potentially obtain code execution via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 3.4% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5062

chromium-browser: use after free in chrome apps

A use after free in Chrome Apps in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to potentially perform out of bounds memory access via a crafted Chrome extension.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5063

chromium-browser: heap overflow in skia

A numeric overflow in Skia in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5068

chromium-browser: race condition in webrtc

Incorrect handling of picture ID in WebRTC in Google Chrome prior to 58.0.3029.96 for Mac, Windows, and Linux allowed a remote attacker to trigger a race condition via a crafted HTML page.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Chrome Linux Kernel and 5 more

CVE-2017-5073

chromium-browser: use after free in print preview

Use after free in print preview in Blink in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5078

chromium-browser: possible command injection in mailto handling

Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as * have an incorrect interaction with xdg-email in xdg-utils, and a space character can be used in front of a command-line argument.

CVSS 3.1 · 8.8 High EPSS 2.8% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Chrome Linux Kernel and 5 more