PT-2017-4190 · Yandex · Yandex Browser

Publicado 2017-03-01 · Atualizado 2020-07-10 · CVE-2016-8508

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Yandex Browser for desktop versions prior to 17.1.1.227

Description The issue is related to errors in security settings of the Protect technology in Yandex Browser, which can be exploited by a remote attacker to hide notifications about suspicious content. This could potentially be used on malicious websites with special content types to prevent Protect warnings from being displayed.

Recommendations For Yandex Browser for desktop versions prior to 17.1.1.227, update to version 17.1.1.227 or later to resolve the issue. As a temporary workaround, consider restricting access to websites with special content types that may exploit this issue until the update is applied.

Correção

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

BDU:2022-03578

CVE-2016-8508

Produtos afetados

Yandex Browser

Referências · 6

• https://bdu.fstec.ru/vul/2022-03578 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-8508 · Aviso do Fabricante
• https://yandex.com/blog/security-changelogs/fixed-in-version-17-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-8508 · Nota de Segurança
• https://yandex.com/bugbounty/i/hall-of-fame-browser · Nota
• http://securityfocus.com/bid/96514 · Nota