PT-2015-6158 · Google+1 · Google Chrome+1

Publicado 2015-04-19 · Atualizado 2018-10-30 · CVE-2015-3335

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 42.0.2311.90

Description The issue is related to the NaClSandbox::InitializeLayerTwoSandbox function in Google Chrome, which does not have RLIMIT AS and RLIMIT DATA limits for Native Client (NaCl) processes. This might make it easier for remote attackers to conduct row-hammer attacks or have unspecified other impact by leveraging the ability to run a crafted program in the NaCl sandbox.

Recommendations For versions prior to 42.0.2311.90, update to version 42.0.2311.90 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2015-1589

CVE-2015-3335

Produtos afetados

Alt Linux

Google Chrome

Referências · 85

• 🔥 https://github.com/tunz/js-vuln-db/blob/master/v8/CVE-2015-1242.md · Exploit
• 🔥 https://github.com/Metnew/uxss-db/tree/master/chrome/CVE-2015-1268 · Exploit
• 🔥 https://code.google.com/p/chromium/issues/detail?id=455839 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1236 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1241 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1244 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-10137 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1258 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-09964 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3335 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-10518 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-09968 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-10128 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-09976 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-10133 · Nota de Segurança