Vulnetix
Try Vulnetix Request Demo
Google Security Advisories · December 2017 — Google Security Advisories
111 advisories 111 CVEs 1 EXPLOITED

GCVE / Google Cloud / Chrome / Android / Project Zero / OSS for 2017-12. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 1 is already weaponised in the wild.

Back to archive Open Console

What would you fix first?

The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.

How Vulnetix ranks risk Get a free API key

Advisories

CVE-2017-13156

Open SourceExploitedVulnCheck KEV listedCRITICAL2017-12-05

An elevation of privilege vulnerability in the Android system (art). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-64211847.

CVEs:CVE-2017-13156

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

DSA-4064-1

Open SourcePoC exploit2017-12-12

chromium-browser - security update

Affected products

ProductStatusVendorPackageEcosystem
chromium-browser affected Debian:9 chromium-browser —
Upstream advisory

openSUSE-SU-2017:3245-1

Open SourcePoC exploitCRITICAL2017-12-08

Security update for chromium

Affected products

ProductStatusVendorPackageEcosystem
chromium affected SUSE:Package Hub 12 SP2 chromium —
Upstream advisory

RHSA-2017:3401

Open SourcePoC exploitCRITICAL2017-12-07

Red Hat Security Advisory: chromium-browser security update

Affected products

ProductStatusVendorPackageEcosystem
chromium-browser affected Red Hat:rhel_extras:6 chromium-browser —
chromium-browser-debuginfo affected Red Hat:rhel_extras:6 chromium-browser-debuginfo —
Upstream advisory

CVE-2017-15412

GooglePoC exploitCRITICAL2017-12-06

Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVEs:CVE-2017-15412

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
libxml2 affected xmlsoft — —
Upstream advisory

CVE-2017-15422

GooglePoC exploitCRITICAL2017-12-06

Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory r...

CVEs:CVE-2017-15422

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
international_components_for_unicode affected icu-project — —
ubuntu_linux affected canonical — —
Upstream advisory

CVE-2017-0872

Open SourcePoC exploitHIGH2017-12-05

A remote code execution vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65290323.

CVEs:CVE-2017-0872

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0876

Open SourcePoC exploitHIGH2017-12-05

A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-64964675.

CVEs:CVE-2017-0876

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0877

Open SourcePoC exploitHIGH2017-12-05

A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-66372937.

CVEs:CVE-2017-0877

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0878

Open SourcePoC exploitHIGH2017-12-05

A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 8.0. Android ID A-65186291.

CVEs:CVE-2017-0878

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11005

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a Use After Free condition can occur during a deinitialization path.

CVEs:CVE-2017-11005

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11006

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a Use After Free condition can occur during positioning.

CVEs:CVE-2017-11006

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-14908

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the SafeSwitch test application does not properly validate the number of blocks to verify.

CVEs:CVE-2017-14908

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-14909

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a count value that is read from a file is not properly validated.

CVEs:CVE-2017-14909

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-14914

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, handles in the global client structure can become stale.

CVEs:CVE-2017-14914

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-14916

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer sizes in the message passing interface are not properly validated.

CVEs:CVE-2017-14916

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-14917

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer sizes in the message passing interface are not properly validated.

CVEs:CVE-2017-14917

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-14918

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the GPS location wireless interface, a Use After Free condition can occur.

CVEs:CVE-2017-14918

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0879

Open SourcePoC exploitCRITICAL2017-12-05

An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65025028.

CVEs:CVE-2017-0879

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13157

Open SourcePoC exploitHIGH2017-12-05

An information disclosure vulnerability in the Android system (activitymanagerservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-32990341.

CVEs:CVE-2017-13157

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13158

Open SourcePoC exploitHIGH2017-12-05

An information disclosure vulnerability in the Android system (activitymanagerservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-32879915.

CVEs:CVE-2017-13158

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13159

Open SourcePoC exploitHIGH2017-12-05

An information disclosure vulnerability in the Android system (activitymanagerservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-32879772.

CVEs:CVE-2017-13159

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13149

Open SourcePoC exploitCRITICAL2017-12-05

An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65719872.

CVEs:CVE-2017-13149

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13150

Open SourcePoC exploitCRITICAL2017-12-05

An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-38328132.

CVEs:CVE-2017-13150

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-15813

Open SourcePoC exploitCRITICAL2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overflow can occur while reading firmware logs.

CVEs:CVE-2017-15813

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13164

Open SourcePoC exploitHIGH2017-12-05

An information disclosure vulnerability in the kernel binder driver. Product: Android. Versions: Android kernel. Android ID A-36007193.

CVEs:CVE-2017-13164

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0873

Open SourcePoC exploitHIGH2017-12-05

A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63316255.

CVEs:CVE-2017-0873

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0874

Open SourcePoC exploitHIGH2017-12-05

A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63315932.

CVEs:CVE-2017-0874

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13148

Open SourcePoC exploitHIGH2017-12-05

A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65717533.

CVEs:CVE-2017-13148

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11031

Open SourcePoC exploitCRITICAL2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the VIDIOC_G_SDE_ROTATOR_FENCE ioctl command can be used to cause a Use After Free condition.

CVEs:CVE-2017-11031

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13152

Open SourcePoC exploitHIGH2017-12-05

An information disclosure vulnerability in the Android media framework (libmedia drm). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-62872384.

CVEs:CVE-2017-13152

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13169

Open SourcePoC exploitHIGH2017-12-05

An information disclosure vulnerability in the kernel camera server. Product: Android. Versions: Android kernel. Android ID A-37512375.

CVEs:CVE-2017-13169

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13175

Open SourcePoC exploitHIGH2017-12-05

An information disclosure vulnerability in the NVIDIA libwilhelm. Product: Android. Versions: Android kernel. Android ID A-64339309. References: N-CVE-2017-13175.

CVEs:CVE-2017-13175

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-6276

Open SourcePoC exploitCRITICAL2017-12-05

NVIDIA mediaserver contains a vulnerability where it is possible a use after free malfunction can occur due to an incorrect bounds check which could enable unauthorized code execution and possibly lead to elevation of privileges. This issue is rated as...

CVEs:CVE-2017-6276

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-6263

Open SourcePoC exploitCRITICAL2017-12-05

NVIDIA driver contains a vulnerability where it is possible a use after free malfunction can occur due to improper usage of the list_for_each kernel macro which could enable unauthorized code execution and possibly lead to elevation of privileges. This...

CVEs:CVE-2017-6263

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11007

Open SourcePoC exploitCRITICAL2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a possibility of stack corruption due to buffer overflow of Partition name while converting ascii string to unicode string in funct...

CVEs:CVE-2017-11007

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-14897

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while handling the QSEOS_RPMB_CHECK_PROV_STATUS_COMMAND, a userspace buffer is directly accessed in kernel space.

CVEs:CVE-2017-14897

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-6262

Open SourcePoC exploitCRITICAL2017-12-05

NVIDIA driver contains a vulnerability where it is possible a use after free malfunction can occur due to a race condition which could enable unauthorized code execution and possibly lead to elevation of privileges. This issue is rated as high. Product...

CVEs:CVE-2017-6262

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11033

Open SourcePoC exploitCRITICAL2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the coresight-tmc driver, a simultaneous read and enable of the ETR device after changing the buffer size may result in a Use After Free ...

CVEs:CVE-2017-11033

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-14896

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a memory allocation without a length field validation in the mobicore driver which can result in an undersize buffer allocation. Ul...

CVEs:CVE-2017-14896

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-9722

Open SourcePoC exploitCRITICAL2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when updating custom EDID (hdmi_tx_sysfs_wta_edid), if edid_size, which is controlled by userspace, is too large, a buffer overflow occurs.

CVEs:CVE-2017-9722

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11019

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the fd allocated during the get_metadata was not closed even though the buffer allocated to the fd was freed. This resulted in a failure dur...

CVEs:CVE-2017-11019

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-14898

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE vendor command, in which attribute QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE conta...

CVEs:CVE-2017-14898

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-14899

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB vendor command, in which attribute QCA_WLAN_VENDOR_ATTR_TXPOWER_SCA...

CVEs:CVE-2017-14899

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-14900

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCA_NL80211_VENDOR_SUBCMD_GET_CHAIN_RSSI vendor command, in which attribute QCA_WLAN_VENDOR_ATTR_MAC_ADDR contains fewe...

CVEs:CVE-2017-14900

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-14901

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE vendor command, in which attribute QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE conta...

CVEs:CVE-2017-14901

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-9698

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improperly specified offset/size values for a submission command could cause a math operation to overflow and could result in an access to a...

CVEs:CVE-2017-9698

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-9700

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer overwrite is possible in fw_name_store if image name is 64 characters.

CVEs:CVE-2017-9700

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-9710

Open SourcePoC exploitCRITICAL2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, IOCTL interface to send QMI NOTIFY REQ messages can be called from multiple contexts which can result in buffer overflow of msg cache.

CVEs:CVE-2017-9710

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-14902

Open SourcePoC exploitCRITICAL2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, due to a race condition in the GLink kernel driver, a Use After Free condition can potentially occur.

CVEs:CVE-2017-14902

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11044

Open SourcePoC exploitCRITICAL2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a KGSL driver function, a race condition exists which can lead to a Use After Free condition.

CVEs:CVE-2017-11044

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11045

Open SourcePoC exploitCRITICAL2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a camera driver function, a race condition exists which can lead to a Use After Free condition.

CVEs:CVE-2017-11045

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11049

Open SourcePoC exploitCRITICAL2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a video driver, a race condition exists which can potentially lead to a buffer overflow.

CVEs:CVE-2017-11049

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-9703

Open SourcePoC exploitCRITICAL2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in a Camera driver can lead to a Use After Free condition.

CVEs:CVE-2017-9703

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-9708

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the camera driver, the function "msm_ois_power_down" is called without a mutex and a race condition can occur in variable "*reg_ptr" of s...

CVEs:CVE-2017-9708

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-9718

Open SourcePoC exploitHIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in a multimedia driver can potentially lead to a buffer overwrite.

CVEs:CVE-2017-9718

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

RHSA-2017:3463

Open SourceEPSS <= 49%HIGH2017-12-14

Red Hat Security Advisory: go-toolset-7 and go-toolset-7-golang security and bug fix update

Affected products

ProductStatusVendorPackageEcosystem
go-toolset-7 affected Red Hat:devtools:2::el7 go-toolset-7 —
go-toolset-7-build affected Red Hat:devtools:2::el7 go-toolset-7-build —
go-toolset-7-dockerfiles affected Red Hat:devtools:2::el7 go-toolset-7-dockerfiles —
go-toolset-7-golang affected Red Hat:devtools:2::el7 go-toolset-7-golang —
go-toolset-7-golang-bin affected Red Hat:devtools:2::el7 go-toolset-7-golang-bin —
go-toolset-7-golang-docs affected Red Hat:devtools:2::el7 go-toolset-7-golang-docs —
go-toolset-7-golang-misc affected Red Hat:devtools:2::el7 go-toolset-7-golang-misc —
go-toolset-7-golang-race affected Red Hat:devtools:2::el7 go-toolset-7-golang-race —
go-toolset-7-golang-src affected Red Hat:devtools:2::el7 go-toolset-7-golang-src —
go-toolset-7-golang-tests affected Red Hat:devtools:2::el7 go-toolset-7-golang-tests —
go-toolset-7-runtime affected Red Hat:devtools:2::el7 go-toolset-7-runtime —
go-toolset-7-scldevel affected Red Hat:devtools:2::el7 go-toolset-7-scldevel —
Upstream advisory

CVE-2017-15407

GoogleEPSS <= 49%CRITICAL2017-12-06

Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to gain code execution via a malicious server.

CVEs:CVE-2017-15407

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

CVE-2017-13160

Open SourceEPSS <= 49%HIGH2017-12-05

A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-37160362.

CVEs:CVE-2017-13160

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-15415

GoogleEPSS <= 49%MEDIUM2017-12-06

Incorrect serialization in IPC in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the value of a pointer via a crafted HTML page.

CVEs:CVE-2017-15415

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

CVE-2017-15413

GoogleEPSS <= 49%HIGH2017-12-06

Type confusion in WebAssembly in V8 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVEs:CVE-2017-15413

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

CVE-2017-15418

GoogleEPSS <= 49%HIGH2017-12-06

Use of uninitialized memory in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVEs:CVE-2017-15418

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

CVE-2017-15409

GoogleEPSS <= 49%CRITICAL2017-12-06

Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVEs:CVE-2017-15409

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

CVE-2017-15410

GoogleEPSS <= 49%CRITICAL2017-12-06

Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

CVEs:CVE-2017-15410

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

CVE-2017-15411

GoogleEPSS <= 49%CRITICAL2017-12-06

Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

CVEs:CVE-2017-15411

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

CVE-2017-15408

GoogleEPSS <= 49%CRITICAL2017-12-06

Heap buffer overflow in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file that is mishandled by PDFium.

CVEs:CVE-2017-15408

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

CVE-2017-15420

GoogleEPSS <= 49%MEDIUM2017-12-06

Incorrect handling of back navigations in error pages in Navigation in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVEs:CVE-2017-15420

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

CVE-2017-15423

GoogleEPSS <= 49%MEDIUM2017-12-06

Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512(password) by inspecting protocol traffic.

CVEs:CVE-2017-15423

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

CVE-2017-15417

GoogleEPSS <= 49%MEDIUM2017-12-06

Inappropriate implementation in Skia canvas composite operations in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVEs:CVE-2017-15417

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

CVE-2017-15416

GoogleEPSS <= 49%CRITICAL2017-12-06

Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka a Blink out-of-bounds read.

CVEs:CVE-2017-15416

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

CVE-2017-13151

Open SourceEPSS <= 49%HIGH2017-12-05

A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63874456.

CVEs:CVE-2017-13151

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-15419

GoogleEPSS <= 49%CRITICAL2017-12-06

Insufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to infer browsing history by triggering a leaked cross-origin URL via a crafted HTML page.

CVEs:CVE-2017-15419

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

CVE-2017-15424

GoogleEPSS <= 49%CRITICAL2017-12-06

Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.

CVEs:CVE-2017-15424

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

CVE-2017-15425

GoogleEPSS <= 49%CRITICAL2017-12-06

Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.

CVEs:CVE-2017-15425

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

CVE-2017-15426

GoogleEPSS <= 49%CRITICAL2017-12-06

Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.

CVEs:CVE-2017-15426

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

openSUSE-SU-2017:3344-1

Open SourceEPSS <= 49%CRITICAL2017-12-16

Security update for chromium

Affected products

ProductStatusVendorPackageEcosystem
chromium affected SUSE:Package Hub 12 SP2 chromium —
Upstream advisory

openSUSE-SU-2017:3346-1

Open SourceEPSS <= 49%CRITICAL2017-12-16

Security update for chromium

Affected products

ProductStatusVendorPackageEcosystem
chromium affected SUSE:Package Hub 12 SP2 chromium —
Upstream advisory

CVE-2017-15429

GoogleEPSS <= 49%CRITICAL2017-12-15

Inappropriate implementation in V8 WebAssembly JS bindings in Google Chrome prior to 63.0.3239.108 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.

CVEs:CVE-2017-15429

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

CVE-2017-15427

GoogleEPSS <= 49%CRITICAL2017-12-06

Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar.

CVEs:CVE-2017-15427

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

CVE-2017-6211

Open SourceEPSS <= 49%HIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the processing of a downlink supplementary services message, a buffer overflow can occur.

CVEs:CVE-2017-6211

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11043

Open SourceEPSS <= 49%HIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a WiFI driver function, an integer overflow leading to heap buffer overflow may potentially occur.

CVEs:CVE-2017-11043

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13162

Open SourceEPSS <= 49%HIGH2017-12-05

An elevation of privilege vulnerability in the kernel binder. Product: Android. Versions: Android kernel. Android ID A-64216036.

CVEs:CVE-2017-13162

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-14907

Open SourceEPSS <= 49%HIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, cryptographic strength is reduced while deriving disk encryption key.

CVEs:CVE-2017-14907

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-9709

Open SourceEPSS <= 49%CRITICAL2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a privilege escalation vulnerability exists in telephony.

CVEs:CVE-2017-9709

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-6280

Open SourceEPSS <= 49%HIGH2017-12-05

NVIDIA driver contains a possible out-of-bounds read vulnerability due to a leak which may lead to information disclosure. This issue is rated as moderate. Android: A-63851980.

CVEs:CVE-2017-6280

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0880

Open SourceEPSS <= 49%HIGH2017-12-05

A denial of service vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID A-65646012.

CVEs:CVE-2017-0880

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13168

Open SourceEPSS <= 49%CRITICAL2017-12-05

An elevation of privilege vulnerability in the kernel scsi driver. Product: Android. Versions: Android kernel. Android ID A-65023233.

CVEs:CVE-2017-13168

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
ubuntu_linux affected canonical — —
Upstream advisory

CVE-2017-13166

Open SourceEPSS <= 49%CRITICAL2017-12-05

An elevation of privilege vulnerability in the kernel v4l2 video driver. Product: Android. Versions: Android kernel. Android ID A-34624167.

CVEs:CVE-2017-13166

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-14903

Open SourceEPSS <= 49%MEDIUM2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the SENDACTIONFRAME IOCTL, a buffer over-read can occur if the payload length is less than 7.

CVEs:CVE-2017-14903

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-14905

Open SourceEPSS <= 49%MEDIUM2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially crafted cfg80211 vendor command, a buffer over-read can occur.

CVEs:CVE-2017-14905

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-14895

Open SourceEPSS <= 49%HIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, after a subsystem reset, iwpriv is not giving correct information.

CVEs:CVE-2017-14895

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-14904

Open SourceEPSS <= 49%HIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a crafted binder request can cause an arbitrary unmap in MediaServer.

CVEs:CVE-2017-14904

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13167

Open SourceEPSS <= 49%CRITICAL2017-12-05

An elevation of privilege vulnerability in the kernel sound timer. Product: Android. Versions: Android kernel. Android ID A-37240993.

CVEs:CVE-2017-13167

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13174

Open SourceEPSS <= 49%CRITICAL2017-12-05

An elevation of privilege vulnerability in the kernel edl. Product: Android. Versions: Android kernel. Android ID A-63100473.

CVEs:CVE-2017-13174

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0837

Open SourceEPSS <= 49%CRITICAL2017-12-05

An elevation of privilege vulnerability in the Android media framework (libaudiopolicymanager). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-64340921.

CVEs:CVE-2017-0837

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0870

Open SourceEPSS <= 49%CRITICAL2017-12-05

An elevation of privilege vulnerability in the Android framework (libminikin). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-62134807.

CVEs:CVE-2017-0870

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0871

Open SourceEPSS <= 49%CRITICAL2017-12-05

An elevation of privilege vulnerability in the Android framework (framework base). Product: Android. Versions: 8.0. Android ID A-65281159.

CVEs:CVE-2017-0871

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13153

Open SourceEPSS <= 49%CRITICAL2017-12-05

An elevation of privilege vulnerability in the Android media framework (libaudioservice). Product: Android. Versions: 8.0. Android ID A-65280854.

CVEs:CVE-2017-13153

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13170

Open SourceEPSS <= 49%CRITICAL2017-12-05

An elevation of privilege vulnerability in the MediaTek display driver. Product: Android. Versions: Android kernel. Android ID A-36102397. References: M-ALPS03359280.

CVEs:CVE-2017-13170

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13171

Open SourceEPSS <= 49%CRITICAL2017-12-05

An elevation of privilege vulnerability in the MediaTek performance service. Product: Android. Versions: Android kernel. Android ID A-64316572. References: M-ALPS03479086.

CVEs:CVE-2017-13171

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13173

Open SourceEPSS <= 49%CRITICAL2017-12-05

An elevation of privilege vulnerability in the MediaTek system server. Product: Android. Versions: Android kernel. Android ID A-28067350. References: M-ALPS02672361.

CVEs:CVE-2017-13173

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-9716

Open SourceEPSS <= 49%HIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the qbt1000 driver implements an alternative channel for usermode applications to talk to QSEE applications.

CVEs:CVE-2017-9716

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11030

Open SourceEPSS <= 49%HIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the HDMI video driver function hdmi_edid_sysfs_rda_res_info(), userspace can perform an arbitrary write into kernel memory.

CVEs:CVE-2017-11030

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13163

Open SourceEPSS <= 49%CRITICAL2017-12-05

An elevation of privilege vulnerability in the kernel mtp usb driver. Product: Android. Versions: Android kernel. Android ID A-37429972.

CVEs:CVE-2017-13163

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13154

Open SourceEPSS <= 49%CRITICAL2017-12-05

An elevation of privilege vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63666573.

CVEs:CVE-2017-13154

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11016

Open SourceEPSS <= 49%HIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when memory allocation fails while creating a calibration block in create_cal_block stale pointers are left uncleared.

CVEs:CVE-2017-11016

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11047

Open SourceEPSS <= 49%HIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a graphics driver ioctl handler, the lack of copy_from_user() function calls may result in writes to kernel memory.

CVEs:CVE-2017-11047

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13161

Open SourceEPSS <= 49%CRITICAL2017-12-05

An elevation of privilege vulnerability in the Broadcom wireless driver. Product: Android. Versions: Android kernel. Android ID A-63930471. References: BC-V2017092501.

CVEs:CVE-2017-13161

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13165

Open SourceEPSS <= 49%CRITICAL2017-12-05

An elevation of privilege vulnerability in the kernel file system. Product: Android. Versions: Android kernel. Android ID A-31269937.

CVEs:CVE-2017-13165

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-13172

Open SourceEPSS <= 49%CRITICAL2017-12-05

An elevation of privilege vulnerability in the MediaTek bluetooth driver. Product: Android. Versions: Android kernel. Android ID A-36493287. References: M-ALPS03495791.

CVEs:CVE-2017-13172

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11042

Open SourceEPSS <= 49%HIGH2017-12-05

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, ImsService and the IQtiImsExt AIDL APIs are not subject to access control.

CVEs:CVE-2017-11042

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.

All months Open Console