Updated_Google_Vulnerabilities

CVE-2016-5203 CVE-2016-5204 CVE-2016-5205 CVE-2016-5206 CVE-2016-5207 CVE-2016-5208 CVE-2016-5209
CISecurity · Jan 24, 2017 · 551cd91 · 551cd91
1 parent 4e921b4
commit 551cd91
Show file tree

Hide file tree

Showing 7 changed files with 7 additions and 7 deletions.
diff --git a/repository/definitions/vulnerability/oval_org.cisecurity_def_1554.xml b/repository/definitions/vulnerability/oval_org.cisecurity_def_1554.xml
@@ -17,7 +17,7 @@
       <product>Google Chrome</product>
     </affected>
     <reference ref_id="CVE-2016-5208" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5208" source="CVE" />
-    <description>Universal XSS in Blink.</description>
+    <description>Blink in Google Chrome prior to 55.0.2883.75 for Linux and Windows, and 55.0.2883.84 for Android allowed possible corruption of the DOM tree during synchronous event handling, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.</description>
     <oval_repository>
       <dates>
         <submitted date="2016-12-09T00:00:00+08:00">

diff --git a/repository/definitions/vulnerability/oval_org.cisecurity_def_1555.xml b/repository/definitions/vulnerability/oval_org.cisecurity_def_1555.xml
@@ -17,7 +17,7 @@
       <product>Google Chrome</product>
     </affected>
     <reference ref_id="CVE-2016-5203" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5203" source="CVE" />
-    <description>Use after free in PDFium.</description>
+    <description>A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.</description>
     <oval_repository>
       <dates>
         <submitted date="2016-12-09T00:00:00+08:00">

diff --git a/repository/definitions/vulnerability/oval_org.cisecurity_def_1557.xml b/repository/definitions/vulnerability/oval_org.cisecurity_def_1557.xml
@@ -17,7 +17,7 @@
       <product>Google Chrome</product>
     </affected>
     <reference ref_id="CVE-2016-5205" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5205" source="CVE" />
-    <description>Universal XSS in Blink.</description>
+    <description>Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac, incorrectly handles deferred page loads, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.</description>
     <oval_repository>
       <dates>
         <submitted date="2016-12-09T00:00:00+08:00">

diff --git a/repository/definitions/vulnerability/oval_org.cisecurity_def_1560.xml b/repository/definitions/vulnerability/oval_org.cisecurity_def_1560.xml
@@ -17,7 +17,7 @@
       <product>Google Chrome</product>
     </affected>
     <reference ref_id="CVE-2016-5206" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5206" source="CVE" />
-    <description>Same-origin bypass in PDFium.</description>
+    <description>The PDF plugin in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly followed redirects, which allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page.</description>
     <oval_repository>
       <dates>
         <submitted date="2016-12-09T00:00:00+08:00">

diff --git a/repository/definitions/vulnerability/oval_org.cisecurity_def_1561.xml b/repository/definitions/vulnerability/oval_org.cisecurity_def_1561.xml
@@ -17,7 +17,7 @@
       <product>Google Chrome</product>
     </affected>
     <reference ref_id="CVE-2016-5204" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5204" source="CVE" />
-    <description>Universal XSS in Blink.</description>
+    <description>Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.</description>
     <oval_repository>
       <dates>
         <submitted date="2016-12-09T00:00:00+08:00">

diff --git a/repository/definitions/vulnerability/oval_org.cisecurity_def_1563.xml b/repository/definitions/vulnerability/oval_org.cisecurity_def_1563.xml
@@ -17,7 +17,7 @@
       <product>Google Chrome</product>
     </affected>
     <reference ref_id="CVE-2016-5207" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5207" source="CVE" />
-    <description>Universal XSS in Blink.</description>
+    <description>In Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android, corruption of the DOM tree could occur during the removal of a full screen element, which allowed a remote attacker to achieve arbitrary code execution via a crafted HTML page.</description>
     <oval_repository>
       <dates>
         <submitted date="2016-12-09T00:00:00+08:00">

diff --git a/repository/definitions/vulnerability/oval_org.cisecurity_def_1567.xml b/repository/definitions/vulnerability/oval_org.cisecurity_def_1567.xml
@@ -17,7 +17,7 @@
       <product>Google Chrome</product>
     </affected>
     <reference ref_id="CVE-2016-5209" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5209" source="CVE" />
-    <description>Out of bounds write in Blink.</description>
+    <description>Bad casting in bitmap manipulation in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.</description>
     <oval_repository>
       <dates>
         <submitted date="2016-12-09T00:00:00+08:00">