PT-2015-5178 · Google+5 · Google Chrome+5
Publicado
2015-03-03
·
Atualizado
2024-06-15
·
CVE-2015-1223
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 41.0.2272.76
Description
The issue is related to multiple use-after-free vulnerabilities in the DOM implementation in Blink, which can be triggered by vectors that cause extraneous change events. This can lead to a denial of service or possibly have other unspecified impacts. The vulnerability is associated with the
initializeTypeInParsing and updateType functions and can be exploited via events for invalid input or input to read-only fields.Recommendations
For Google Chrome versions prior to 41.0.2272.76, update to version 41.0.2272.76 or later to resolve the issue. As a temporary workaround, consider restricting access to the
initializeTypeInParsing and updateType functions in the core/html/HTMLInputElement.cpp file until a patch is available. Avoid using the initializeTypeInParsing and updateType functions in the affected API endpoints until the issue is resolved.Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Google Chrome
Opera
Red Hat
Suse
Ubuntu