PT-2015-1672 · Google+6 · Google Chrome+6
Atte Kettunen
·
Publicado
2015-07-21
·
Atualizado
2024-06-15
·
CVE-2015-1270
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 44.0.2403.89
Description
The issue is related to the ucnv io getConverterName function in International Components for Unicode (ICU), which mishandles converter names with initial x- substrings. This allows remote attackers to cause a denial of service (read of uninitialized memory) or possibly have unspecified other impact via a crafted file. The vulnerability exists due to incorrect handling of converter names, enabling remote attackers to exploit it using a specially formed file.
Recommendations
For Google Chrome versions prior to 44.0.2403.89, update to version 44.0.2403.89 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
ucnv io getConverterName function until a patch is available. Avoid using converter names with initial x- substrings in the affected function to minimize the risk of exploitation.Exploit
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Google Chrome
International Components For Unicode
Opera
Red Hat
Suse
Ubuntu