# CVEs published 2016-06-05

36 CVEs were published on June 5, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-1672](https://cve.now/CVE-2016-1672.md): The ModuleSystem::RequireForJsInner function in extensions/renderer/module\_system.cc in the extension bindings in Google Chrome before 51.0. (no CVSS)
- [CVE-2016-1673](https://cve.now/CVE-2016-1673.md): Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy via unspecified vectors. (no CVSS)
- [CVE-2016-1674](https://cve.now/CVE-2016-1674.md): The extensions subsystem in Google Chrome before 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified vecto (no CVSS)
- [CVE-2016-1675](https://cve.now/CVE-2016-1675.md): Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy by leveraging the mishandling (no CVSS)
- [CVE-2016-1676](https://cve.now/CVE-2016-1676.md): extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.63 does not properly use prototypes, wh (no CVSS)
- [CVE-2016-1677](https://cve.now/CVE-2016-1677.md): uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attac (no CVSS)
- [CVE-2016-1678](https://cve.now/CVE-2016-1678.md): objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, whic (no CVSS)
- [CVE-2016-1679](https://cve.now/CVE-2016-1679.md): The ToV8Value function in content/child/v8\_value\_converter\_impl.cc in the V8 bindings in Google Chrome before 51.0.2704.63 does not properly (no CVSS)
- [CVE-2016-1680](https://cve.now/CVE-2016-1680.md): Use-after-free vulnerability in ports/SkFontHost\_FreeType.cpp in Skia, as used in Google Chrome before 51.0.2704.63, allows remote attackers (no CVSS)
- [CVE-2016-1681](https://cve.now/CVE-2016-1681.md): Heap-based buffer overflow in the opj\_j2k\_read\_SPCod\_SPCoc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 51.0.270 (no CVSS)
- [CVE-2016-1682](https://cve.now/CVE-2016-1682.md): The ServiceWorkerContainer::registerServiceWorkerImpl function in WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.cpp in Blink, (no CVSS)
- [CVE-2016-1683](https://cve.now/CVE-2016-1683.md): numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles namespace nodes, which allows remote attackers (no CVSS)
- [CVE-2016-1684](https://cve.now/CVE-2016-1684.md): numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles the i format token for xsl:number data, which a (no CVSS)
- [CVE-2016-1685](https://cve.now/CVE-2016-1685.md): core/fxge/ge/fx\_ge\_text.cpp in PDFium, as used in Google Chrome before 51.0.2704.63, miscalculates certain index values, which allows remote (no CVSS)
- [CVE-2016-1686](https://cve.now/CVE-2016-1686.md): The CPDF\_DIBSource::CreateDecoder function in core/fpdfapi/fpdf\_render/fpdf\_render\_loadimage.cpp in PDFium, as used in Google Chrome before (no CVSS)
- [CVE-2016-1687](https://cve.now/CVE-2016-1687.md): The renderer implementation in Google Chrome before 51.0.2704.63 does not properly restrict public exposure of classes, which allows remote (no CVSS)
- [CVE-2016-1688](https://cve.now/CVE-2016-1688.md): The regexp (aka regular expression) implementation in Google V8 before 5.0.71.40, as used in Google Chrome before 51.0.2704.63, mishandles e (no CVSS)
- [CVE-2016-1689](https://cve.now/CVE-2016-1689.md): Heap-based buffer overflow in content/renderer/media/canvas\_capture\_handler.cc in Google Chrome before 51.0.2704.63 allows remote attackers (no CVSS)
- [CVE-2016-1690](https://cve.now/CVE-2016-1690.md): The Autofill implementation in Google Chrome before 51.0.2704.63 mishandles the interaction between field updates and JavaScript code that t (no CVSS)
- [CVE-2016-1691](https://cve.now/CVE-2016-1691.md): Skia, as used in Google Chrome before 51.0.2704.63, mishandles coincidence runs, which allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2016-1692](https://cve.now/CVE-2016-1692.md): WebKit/Source/core/css/StyleSheetContents.cpp in Blink, as used in Google Chrome before 51.0.2704.63, permits cross-origin loading of CSS st (no CVSS)
- [CVE-2016-1693](https://cve.now/CVE-2016-1693.md): browser/safe\_browsing/srt\_field\_trial\_win.cc in Google Chrome before 51.0.2704.63 does not use the HTTPS service on dl.google.com to obtain (no CVSS)
- [CVE-2016-1694](https://cve.now/CVE-2016-1694.md): browser/browsing\_data/browsing\_data\_remover.cc in Google Chrome before 51.0.2704.63 deletes HPKP pins during cache clearing, which makes it (no CVSS)
- [CVE-2016-1695](https://cve.now/CVE-2016-1695.md): Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.63 allow attackers to cause a denial of service or possibly have othe (no CVSS)
- [CVE-2016-1696](https://cve.now/CVE-2016-1696.md): The extensions subsystem in Google Chrome before 51.0.2704.79 does not properly restrict bindings access, which allows remote attackers to b (no CVSS)
- [CVE-2016-1697](https://cve.now/CVE-2016-1697.md): The FrameLoader::startLoad function in WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 51.0.2704.79, doe (no CVSS)
- [CVE-2016-1698](https://cve.now/CVE-2016-1698.md): The createCustomType function in extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.79 doe (no CVSS)
- [CVE-2016-1699](https://cve.now/CVE-2016-1699.md): WebKit/Source/devtools/front\_end/devtools.js in the Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 51.0. (no CVSS)
- [CVE-2016-1700](https://cve.now/CVE-2016-1700.md): extensions/renderer/runtime\_custom\_bindings.cc in Google Chrome before 51.0.2704.79 does not consider side effects during creation of an arr (no CVSS)
- [CVE-2016-1701](https://cve.now/CVE-2016-1701.md): The Autofill implementation in Google Chrome before 51.0.2704.79 mishandles the interaction between field updates and JavaScript code that t (no CVSS)
- [CVE-2016-1702](https://cve.now/CVE-2016-1702.md): The SkRegion::readFromMemory function in core/SkRegion.cpp in Skia, as used in Google Chrome before 51.0.2704.79, does not validate the inte (no CVSS)
- [CVE-2016-1703](https://cve.now/CVE-2016-1703.md): Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.79 allow attackers to cause a denial of service or possibly have othe (no CVSS)
- [CVE-2016-1212](https://cve.now/CVE-2016-1212.md): Directory traversal vulnerability in futomi MP Form Mail CGI Professional Edition 3.2.3 and earlier allows remote authenticated administrato (no CVSS)
- [CVE-2016-1222](https://cve.now/CVE-2016-1222.md): Cross-site scripting (XSS) vulnerability in Kobe Beauty php-contact-form before 2016-05-18 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2016-1229](https://cve.now/CVE-2016-1229.md): Cross-site scripting (XSS) vulnerability in HumHub 0.20.0-beta.1 through 0.20.1 and 1.0.0-beta before 1.0.0-beta.3 allows remote authenticat (no CVSS)
- [CVE-2016-1230](https://cve.now/CVE-2016-1230.md): Cross-site scripting (XSS) vulnerability in NTT PC Communications WebARENA Service formmail before 2.2.1 allows remote attackers to inject a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-06-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.