CVE-2016-1617
chromium-browser: various fixes from internal audits
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 48.0.2564.82, does not apply http policies to https URLs and does not apply ws policies to wss URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report.
La función CSPSource::schemeMatches en WebKit/Source/core/frame/csp/CSPSource.cpp en la implementación de Content Security Policy (CSP) en Blink, tal como se utiliza en Google Chrome en versiones anteriores a 48.0.2564.82, no aplica políticas http a URLs https y no aplica políticas ws a URLs wss, lo que hace más fácil para atacantes remotos determinar si un sitio web específico HSTS ha sido visitado leyendo un informe CSP.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-01-12 CVE Reserved
- 2016-01-25 CVE Published
- 2023-11-08 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (14)
URL | Tag | Source |
---|---|---|
http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html | X_refsource_confirm | |
http://www.securityfocus.com/bid/81430 | Vdb Entry | |
http://www.securitytracker.com/id/1034801 | Vdb Entry | |
https://code.google.com/p/chromium/issues/detail?id=544765 | X_refsource_confirm | |
https://codereview.chromium.org/1455973003 | X_refsource_confirm |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Google Search vendor "Google" | Chrome Search vendor "Google" for product "Chrome" | <= 47.0.2526.106 Search vendor "Google" for product "Chrome" and version " <= 47.0.2526.106" | - |
Affected
|