PT-2015-1938 · Opera+4 · Opera+5
Igrigorik
·
Publicado
2015-08-29
·
Atualizado
2024-06-15
·
CVE-2015-1300
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 45.0.2454.85
Opera versions prior to 45.0.2454.85
Description
The issue is related to the FrameFetchContext::updateTimingInfoForIFrameNavigation function in the Blink component of Google Chrome, which does not properly restrict the availability of IFRAME Resource Timing API times. This allows remote attackers to obtain sensitive information via crafted JavaScript code that leverages a history.back call. The vulnerability can be exploited by a remote attacker to gain access to protected information.
Recommendations
For Google Chrome versions prior to 45.0.2454.85, update to version 45.0.2454.85 or later to resolve the issue.
For Opera versions prior to 45.0.2454.85, update to a version that includes the fix for this issue, as the exact version is not specified.
As a temporary workaround, consider restricting the use of the
history.back call in crafted JavaScript code to minimize the risk of exploitation.Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Blink
Google Chrome
Opera
Red Hat
Ubuntu