The regulator_ena_gpio_free function in drivers/regulator/core.c in the Linux kernel before 3.19 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted application.

CVE-2014-9940: Android Security Bulletin—May 2017

A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

About Monorail User Guide Release Notes Feedback on Monorail Terms Privacy

CVE-2017-5039: 679649 - chromium - An open-source project to help move the web forward.

V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android was missing a neutering check, which allowed a remote attacker to read values in memory via a crafted HTML page.

CVE-2017-5040: 691323 - chromium - An open-source project to help move the web forward.

A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to have an unspecified impact via a crafted PDF file.

CVE-2017-5036: 691371 - chromium - An open-source project to help move the web forward.

Google Chrome prior to 57.0.2987.98 for Windows and Mac had a race condition, which could cause Chrome to display incorrect certificate information for a site.

CVE-2017-5035: 688425 - chromium - An open-source project to help move the web forward.

The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.

**Commit 08ab2774** authored Jan 12, 2017 by ![Nick Wellnhofer's avatar](https://secure.gravatar.com/avatar/bfdcb4596e9da98cccbf9a0069fdff6c?s=48&d=identicon "Nick Wellnhofer")

Browse files

**Check for integer overflow in xsltAddTextString**

Limit buffer size in xsltAddTextString to INT\_MAX. The issue can be
exploited to trigger an out of bounds write on 64-bit systems.

Originally reported to Chromium:

https://crbug.com/676623

*   Changes 2

...

...

@@ -813,13 +813,32 @@ xsltAddTextString(xsltTransformContextPtr ctxt, xmlNodePtr target,

return(target);

if (ctxt\->lasttext \== target\->content) {

int minSize;

if (ctxt\->lasttuse + len \>= ctxt\->lasttsize) {

/\* Check for integer overflow accounting for NUL terminator. \*/

if (len \>= INT\_MAX \- ctxt\->lasttuse) {

xsltTransformError(ctxt, NULL, target,

"xsltCopyText: text allocation failed\\n");

return(NULL);

}

minSize \= ctxt\->lasttuse + len + 1;

if (ctxt\->lasttsize < minSize) {

xmlChar \*newbuf;

int size;

int extra;

/\* Double buffer size but increase by at least 100 bytes. \*/

extra \= minSize < 100 ? 100 : minSize;

/\* Check for integer overflow. \*/

if (extra \> INT\_MAX \- ctxt\->lasttsize) {

size \= INT\_MAX;

}

else {

size \= ctxt\->lasttsize + extra;

}

size \= ctxt\->lasttsize + len + 100;

size \*= 2;

newbuf \= (xmlChar \*) xmlRealloc(target\->content,size);

if (newbuf \== NULL) {

xsltTransformError(ctxt, NULL, target,

...

...

...

...

@@ -1754,8 +1754,8 @@ struct \_xsltTransformContext {

\* Speed optimization when coalescing text nodes

\*/

const xmlChar \*lasttext; /\* last text node content \*/

unsigned int lasttsize; /\* last text node size \*/

unsigned int lasttuse; /\* last text node use \*/

int lasttsize; /\* last text node size \*/

int lasttuse; /\* last text node use \*/

/\*

\* Per Context Debugging

\*/

...

...

CVE-2017-5029: Check for integer overflow in xsltAddTextString (08ab2774) · Commits · GNOME / libxslt

Chrome Apps in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac had a use after free bug in GuestView, which allowed a remote attacker to perform an out of bounds memory read via a crafted Chrome extension.

CVE-2017-5038: 695476 - chromium - An open-source project to help move the web forward.

An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.

CVE-2017-5037: 679640 - chromium - An open-source project to help move the web forward.

Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed an attacker on the local network segment to initiate connections to arbitrary URLs and observe any plaintext cookies sent.

CVE-2017-5042: 671932 - chromium - An open-source project to help move the web forward.

Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.

Tag

#google