PT-2016-3047 · Opera+5 · Opera+5

Publicado

2016-12-01

·

Atualizado

2024-06-15

·

CVE-2016-5205

CVSS v3.1

6.1

Média

VetorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 55.0.2883.75 Opera versions prior to 55.0.2883.75
Description The issue arises from incorrect handling of deferred page loads by the Blink component in Google Chrome and Opera, allowing a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. This could potentially enable an attacker to obtain information about the integration platform and operating system.
Recommendations For Google Chrome versions prior to 55.0.2883.75, update to version 55.0.2883.75 or later. For Opera versions prior to 55.0.2883.75, update to version 55.0.2883.75 or later. As a temporary workaround, consider restricting access to crafted HTML pages until a patch is available.

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALT-PU-2016-2425
BDU:2017-00146
CVE-2016-5205
DSA-3731-1
MGASA-2016-0419
OPENSUSE-SU-2016_3108-1
OPENSUSE-SU-2017:0563-1
OPENSUSE-SU-2024:10171-1
RHSA-2016:2919
RHSA-2016_2919
USN-3153-1

Produtos afetados

Alt Linux
Google Chrome
Opera
Red Hat
Suse
Ubuntu