PT-2015-1194 · Google+3 · Google Chrome+3
Published
2015-05-19
·
Updated
2024-06-15
·
CVE-2015-1255
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 43.0.2357.65
Description
The issue is related to a use-after-free vulnerability in the WebAudio implementation, specifically in the content/renderer/media/webaudio capturer source.cc file. This vulnerability can be exploited by a remote attacker to cause a denial of service, potentially leading to heap memory corruption. The vulnerability is caused by improper handling of a stop action for an audio track.
Recommendations
For Google Chrome versions prior to 43.0.2357.65, update to version 43.0.2357.65 or later to resolve the issue. As a temporary workaround, consider disabling the WebAudio implementation until a patch is available. Restrict access to audio tracks to minimize the risk of exploitation. Avoid using the
webaudio capturer source function in the affected API endpoint until the issue is resolved.Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Google Chrome
Red Hat
Ubuntu