Vulnerabilities > Debian > Debian Linux > Medium

DATE CVE VULNERABILITY TITLE RISK
2016-06-05 CVE-2016-1688 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The regexp (aka regular expression) implementation in Google V8 before 5.0.71.40, as used in Google Chrome before 51.0.2704.63, mishandles external string sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted JavaScript code.
network
low complexity
debian canonical redhat suse opensuse google CWE-119
6.5
2016-06-05 CVE-2016-1687 Information Exposure vulnerability in multiple products
The renderer implementation in Google Chrome before 51.0.2704.63 does not properly restrict public exposure of classes, which allows remote attackers to obtain sensitive information via vectors related to extensions.
network
low complexity
debian redhat suse opensuse google CWE-200
6.5
2016-06-05 CVE-2016-1686 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The CPDF_DIBSource::CreateDecoder function in core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp in PDFium, as used in Google Chrome before 51.0.2704.63, mishandles decoder-initialization failure, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.
network
low complexity
google debian redhat suse opensuse CWE-119
6.5
2016-06-05 CVE-2016-1685 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
core/fxge/ge/fx_ge_text.cpp in PDFium, as used in Google Chrome before 51.0.2704.63, miscalculates certain index values, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.
network
low complexity
google debian redhat suse opensuse CWE-119
6.5
2016-06-05 CVE-2016-1682 Improper Access Control vulnerability in multiple products
The ServiceWorkerContainer::registerServiceWorkerImpl function in WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.cpp in Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a ServiceWorker registration.
network
low complexity
google debian canonical redhat suse opensuse CWE-284
6.1
2016-06-05 CVE-2016-1677 Information Exposure vulnerability in multiple products
uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain sensitive information by calling the decodeURI function and leveraging "type confusion."
network
low complexity
google debian canonical redhat opensuse suse CWE-200
6.5
2016-06-01 CVE-2016-4454 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read.
local
low complexity
qemu canonical debian CWE-119
6.0
2016-06-01 CVE-2016-4453 Infinite Loop vulnerability in multiple products
The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command.
local
low complexity
qemu canonical debian CWE-835
4.4
2016-05-25 CVE-2016-4020 The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).
local
low complexity
qemu canonical debian redhat
6.5
2016-05-23 CVE-2016-4037 Resource Exhaustion vulnerability in multiple products
The ehci_advance_state function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular split isochronous transfer descriptor (siTD) list, a related issue to CVE-2015-8558.
local
low complexity
fedoraproject canonical qemu debian CWE-400
6.0