PT-2015-1934 · Opera+3 · Opera+3
Matt Giuca
·
Publicado
2015-08-29
·
Atualizado
2024-06-15
·
CVE-2015-1296
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 45.0.2454.85
Opera versions prior to 45.0.2454.85
Description
The issue concerns the UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc, which does not prevent the display of Unicode LOCK characters in the omnibox. This makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages.
Recommendations
For Google Chrome versions prior to 45.0.2454.85, update to version 45.0.2454.85 or later to resolve the issue.
For Opera versions prior to 45.0.2454.85, update to version 45.0.2454.85 or later to resolve the issue.
As a temporary workaround, consider restricting the display of Unicode characters in the omnibox to minimize the risk of exploitation.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Google Chrome
Opera
Red Hat