CVE-2015-1241

Опубликовано: 19 апр. 2015

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

Google Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation with the handling of touch events and gesture events, which allows remote attackers to trigger unintended UI actions via a crafted web site that conducts a "tapjacking" attack.

Ссылки

http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html
Release Notes
http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html
Mitigation
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
Mitigation
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0816.html
Third Party Advisory
http://ubuntu.com/usn/usn-2570-1
Third Party Advisory
http://www.debian.org/security/2015/dsa-3238
Third Party Advisory
http://www.securitytracker.com/id/1032209
Broken Link
Third Party Advisory
VDB Entry
https://code.google.com/p/chromium/issues/detail?id=418402
Exploit
Issue Tracking
Vendor Advisory
https://codereview.chromium.org/628763003
Issue Tracking
Vendor Advisory
https://codereview.chromium.org/660663002
Issue Tracking
Vendor Advisory
https://codereview.chromium.org/717573004
Issue Tracking
Vendor Advisory
https://codereview.chromium.org/868123002
Issue Tracking
Vendor Advisory
https://security.gentoo.org/glsa/201506-04
Third Party Advisory
http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html
Release Notes
http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html
Mitigation
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
Mitigation
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0816.html
Third Party Advisory
http://ubuntu.com/usn/usn-2570-1
Third Party Advisory
http://www.debian.org/security/2015/dsa-3238
Third Party Advisory
http://www.securitytracker.com/id/1032209
Broken Link
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Версия до 42.0.2311.90 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

Конфигурация 5

cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*

Конфигурация 6

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:6.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:6.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

EPSS

Процентиль: 86%

0.02832

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-1021

Связанные уязвимости

CVE-2015-1241

ubuntu

почти 11 лет назад

CVE-2015-1241

redhat

почти 11 лет назад

CVE-2015-1241

debian

почти 11 лет назад

Google Chrome before 42.0.2311.90 does not properly consider the inter ...

GHSA-5rxr-h5mf-7p7w

github

больше 3 лет назад

BDU:2015-09969

fstec

почти 11 лет назад

Уязвимость браузера Google Chrome, позволяющая удаленному нарушителю выполнить действия, непредусмотренные интерфейсом браузера

EPSS

Процентиль: 86%

0.02832

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-1021