PT-2015-1675 · Google+4 · Google Chrome+4
Publicado
2015-07-21
·
Atualizado
2024-06-15
·
CVE-2015-1274
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 44.0.2403.89
Description
The issue is related to errors in security settings, allowing remote attackers to execute arbitrary code by providing a crafted file and leveraging a user's previous "Always open files of this type" choice. This is connected to download commands.cc and download prefs.cc. The exploitation of this issue can enable remote attackers to run arbitrary code using a specially formed file.
Recommendations
For versions prior to 44.0.2403.89, update to version 44.0.2403.89 or later to resolve the issue. As a temporary workaround, consider restricting the auto-open list to omit all dangerous file types until a patch is available. Avoid using the "Always open files of this type" option for potentially dangerous file types in the affected versions.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Google Chrome
Opera
Red Hat
Suse