PT-2015-7359 · Opera+6 · Opera+6
Michael Ficarra
·
Publicado
2015-12-01
·
Atualizado
2024-06-15
·
CVE-2015-6785
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 47.0.2526.73
Opera (affected versions not specified)
Description
The issue is related to the Content Security Policy (CSP) implementation, specifically the CSPSource::hostMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp. This function accepts an x.y hostname as a match for a *.x.y pattern, which might allow remote attackers to bypass intended access restrictions in certain circumstances by leveraging a policy that was intended to be specific to subdomains.
Recommendations
For Google Chrome versions prior to 47.0.2526.73, update to version 47.0.2526.73 or later to resolve the issue.
For Opera, at the moment, there is no information about a newer version that contains a fix for this issue.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Google Chrome
Opera
Red Hat
Suse
Ubuntu
Webkit