Vulnerability CVE-2015-1210
Published: 2015-02-06

Description:
The V8ThrowException::createDOMException function in bindings/core/v8/V8ThrowException.cpp in the V8 bindings in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, does not properly consider frame access restrictions during the throwing of an exception, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Microsoft -> Windows 
Linux -> Linux kernel 
Google -> Chrome 
Apple -> Mac os x 

 References:
http://googlechromereleases.blogspot.com/2015/02/chrome-for-android-update.html
http://googlechromereleases.blogspot.com/2015/02/stable-channel-update.html
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00005.html
http://rhn.redhat.com/errata/RHSA-2015-0163.html
http://secunia.com/advisories/62917
http://secunia.com/advisories/62925
http://security.gentoo.org/glsa/glsa-201502-13.xml
http://www.securityfocus.com/bid/72497
http://www.securitytracker.com/id/1031709
http://www.ubuntu.com/usn/USN-2495-1
https://code.google.com/p/chromium/issues/detail?id=453979
https://exchange.xforce.ibmcloud.com/vulnerabilities/100716
https://src.chromium.org/viewvc/blink?revision=189365&view=revision
Copyright 2024, cxsecurity.com

 

Back to Top