PT-2017-4190 · Yandex · Yandex Browser

Published 2017-03-01 · Updated 2020-07-10 · CVE-2016-8508

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Yandex Browser for desktop versions prior to 17.1.1.227

Description The issue is related to errors in security settings of the Protect technology in Yandex Browser, which can be exploited by a remote attacker to hide notifications about suspicious content. This could potentially be used on malicious websites with special content types to prevent Protect warnings from being displayed.

Recommendations For Yandex Browser for desktop versions prior to 17.1.1.227, update to version 17.1.1.227 or later to resolve the issue. As a temporary workaround, consider restricting access to websites with special content types that may exploit this issue until the update is applied.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2022-03578

CVE-2016-8508

Affected Products

Yandex Browser

References · 6

• https://bdu.fstec.ru/vul/2022-03578 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8508 · Vendor Advisory
• https://yandex.com/blog/security-changelogs/fixed-in-version-17-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8508 · Security Note
• https://yandex.com/bugbounty/i/hall-of-fame-browser · Note
• http://securityfocus.com/bid/96514 · Note