PT-2011-5038 · Google+1 · Google Chrome+2

Published 2011-12-07 · Updated 2017-09-19 · CVE-2011-4692

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions WebKit, as used in Apple Safari versions 5.1.1 and earlier WebKit, as used in Google Chrome versions 15 and earlier

Description The issue allows remote attackers to determine whether an image exists in the browser cache via crafted JavaScript code, by capturing data about the time required for image loading. This can be achieved by exploiting the lack of prevention of data capture about image loading times.

Recommendations For Apple Safari versions 5.1.1 and earlier, update to a version later than 5.1.1 to resolve the issue. For Google Chrome versions 15 and earlier, update to a version later than 15 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-4692

Affected Products

Google Chrome

Safari

Webkit

References · 7

• 🔥 http://oxplot.github.com/visipisi/visipisi.html · Exploit
• 🔥 http://lcamtuf.coredump.cx/cachetime · Exploit
• https://ubuntu.com/security/CVE-2011-4692 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2011-4692 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2011-4692 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-4692 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14098 · Note