Vulnerability CVE-2015-1296
Published: 2015-09-03   Modified: 2015-09-04

Description:
The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages.

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Google -> Chrome 

 References:
http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html
http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html
http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html
http://rhn.redhat.com/errata/RHSA-2015-1712.html
http://www.debian.org/security/2015/dsa-3351
http://www.securitytracker.com/id/1033472
https://code.google.com/p/chromium/issues/detail?id=421332
https://codereview.chromium.org/1180393003/
https://codereview.chromium.org/1189553002/
https://security.gentoo.org/glsa/201603-09
Copyright 2024, cxsecurity.com

 

Back to Top