Hi, we have received notifications for the following vulnerabilities and related CVE's: Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution Out of bounds write in QUIC (CVE-2017-15407) Heap buffer overflow in PDFium (CVE-2017-15408) Out of bounds write in Skia (CVE-2017-15409) Use after free in PDFium (CVE-2017-15410, CVE-2017-15411) Use after free in libXML (CVE-2017-15412) Type confusion in WebAssembly (CVE-2017-15413) Pointer information disclosure in IPC call (CVE-2017-15415) Out of bounds read in Blink (CVE-2017-15416) Cross origin information disclosure in Skia (CVE-2017-15417) Use of uninitialized value in Skia (CVE-2017-15418) Cross origin leak of redirect URL in Blink (CVE-2017-15419) URL spoofing in Omnibox (CVE-2017-15420) Integer overflow in ICU (CVE-2017-15422) Issue with SPAKE implementation in BoringSSL (CVE-2017-15423) URL Spoof in Omnibox (CVE-2017-15424, CVE-2017-15425, CVE-2017-15426) Insufficient blocking of JavaScript in Omnibox (CVE-2017-15427) Multiple Vulnerabilities in Apache Struts Could Allow for Remote Code Execution A denial of service vulnerability exists due to an outdated JSON-lib library utilized by a REST plugin. (CVE-2017-15707) A remote code execution vulnerability exists because the REST Plugin utilizes Jackson JSON library for data binding. (CVE-2017-7525) But could not find the CVE's in the Threat Vault. Would like to understand how PaloAlto determines which CVE's should be included in the Threat Updates. Regards Mario
... View more