PT-2015-7357 · Google+1 · Google Chrome+2

Michal Bednarski · Published 2015-12-06 · Updated 2024-06-15 · CVE-2015-6783

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions crazy linker (aka Crazy Linker) versions prior to the version included in Google Chrome 47.0.2526.73 Google Chrome versions prior to 47.0.2526.73

Description The issue is related to the FindStartOffsetOfFileInZipFile function in crazy linker zip.cpp, which improperly searches for an EOCD record. This allows attackers to bypass a signature-validation requirement via a crafted ZIP archive.

Recommendations For crazy linker (aka Crazy Linker) versions prior to the version included in Google Chrome 47.0.2526.73, update to a version included in Google Chrome 47.0.2526.73 or later. For Google Chrome versions prior to 47.0.2526.73, update to version 47.0.2526.73 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-6783

OPENSUSE-SU-2015_2290-1

OPENSUSE-SU-2024:10171-1

OPENSUSE-SU-2024:12948-1

Affected Products

Google Chrome

Suse

Crazy Linker

References · 2387

• 🔥 https://github.com/tunz/js-vuln-db/blob/master/v8/CVE-2015-6771.md · Exploit
• 🔥 https://github.com/tunz/js-vuln-db/blob/master/v8/CVE-2015-6764.md · Exploit
• 🔥 https://github.com/Metnew/uxss-db/tree/master/chrome/CVE-2015-6769 · Exploit
• 🔥 https://github.com/Metnew/uxss-db/tree/master/chrome/CVE-2015-6770 · Exploit
• https://security.gentoo.org/glsa/201603-09 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00271 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-6783 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6783 · Security Note
• https://bdu.fstec.ru/vul/2015-12255 · Security Note
• https://bdu.fstec.ru/vul/2016-00008 · Security Note
• https://bdu.fstec.ru/vul/2015-12254 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10171-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00967 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory