CVE-2017-5035

chromium-browser: incorrect security ui in omnibox

Google Chrome prior to 57.0.2987.98 for Windows and Mac had a race condition, which could cause Chrome to display incorrect certificate information for a site.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apple Debian Google and 2 more

Products

Macos Debian Linux Chrome and 5 more

CVE-2017-5029

chromium-browser: integer overflow in libxslt

The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Apple Debian Google and 4 more

Products

Macos Debian Linux Android and 8 more

CVE-2017-5036

chromium-browser: use after free in pdfium

A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to have an unspecified impact via a crafted PDF file.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5037

chromium-browser: multiple out of bounds writes in chunkdemuxer

An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-2982

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in a routine related to player shutdown. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 6.0% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2017-5121

chromium-browser: out-of-bounds access in v8

Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.

CVSS 3.1 · 8.8 High EPSS 5.3% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Chrome and 6 more

CVE-2017-2984

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability in the h264 decoder routine. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 18.2% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2017-2993

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability related to event handlers. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 6.0% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2017-2991

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in the h264 codec (related to decompression). Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 8.7% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2017-2990

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in the h264 decompression routine. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 9.7% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2017-2985

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in the ActionScript 3 BitmapData class. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 21.8% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2017-5100

chromium-browser: use after free in chrome apps

A use after free in Apps in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Debian Google Microsoft and 1 more

Products

Debian Linux Chrome Windows and 4 more

CVE-2017-2986

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability in the Flash Video (FLV) codec. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 30.9% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2017-2995

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable type confusion vulnerability related to the MessageChannel class. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 6.4% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2017-2996

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in Primetime SDK. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 4.9% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2017-2992

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability when parsing an MP4 header. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 32.7% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2017-3085

flash-plugin: Information Disclosure via Security Bypass issue fixed in APSB17-23

Adobe Flash Player versions 26.0.0.137 and earlier have a security bypass vulnerability that leads to information disclosure when performing URL redirect.

CVSS 3.1 · 7.4 High EPSS 4.5% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 9 more

CVE-2017-3072

flash-plugin: multiple code execution issues fixed in APSB17-15

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the BitmapData class. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 5.0% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 9 more

CVE-2017-2988

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability when performing garbage collection. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 18.1% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2017-3071

flash-plugin: multiple code execution issues fixed in APSB17-15

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free vulnerability when masking display objects. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 6.2% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 9 more