PT-2015-2723 · Google+3 · Google Chrome+3

Published 2015-09-29 · Updated 2024-06-15 · CVE-2015-1302

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 46.0.2490.86

Description The issue exists due to insufficient input validation in the PDF viewer component of Google Chrome. This allows a remote attacker to bypass existing access restrictions or load a plugin by manipulating components such as pdf.js and out of process instance.cc. The vulnerability can be exploited to bypass the Same Origin Policy via an unintended embedder or unintended plugin loading.

Recommendations For Google Chrome versions prior to 46.0.2490.86, update to version 46.0.2490.86 or later to resolve the issue. As a temporary workaround, consider disabling the pdf.js component until a patch is available. Restrict access to the out of process instance.cc component to minimize the risk of exploitation. Avoid using the PDF viewer in Google Chrome until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2015-1984

BDU:2015-12088

CVE-2015-1302

DSA-3415-1

MGASA-2015-0448

OPENSUSE-SU-2024:10171-1

OPENSUSE-SU-2024:12948-1

RHSA-2015:1841

RHSA-2015_1841

Affected Products

Alt Linux

Google Chrome

Opera

Red Hat

References · 2397

• 🔥 https://github.com/tunz/js-vuln-db/blob/master/v8/CVE-2015-6771.md · Exploit
• 🔥 https://github.com/tunz/js-vuln-db/blob/master/v8/CVE-2015-6764.md · Exploit
• 🔥 https://github.com/Metnew/uxss-db/tree/master/chrome/CVE-2015-6769 · Exploit
• 🔥 https://github.com/Metnew/uxss-db/tree/master/chrome/CVE-2015-6770 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6778 · Security Note
• https://advisories.mageia.org/MGASA-2015-0448.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6767 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6773 · Security Note
• https://security.gentoo.org/glsa/201603-09 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-1302 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6768 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6764 · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0448 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-11/msg00121.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6779 · Security Note