Upstream information

CVE-2015-1247 at MITRE

Description

The SearchEngineTabHelper::OnPageHasOSDD function in browser/ui/search_engines/search_engine_tab_helper.cc in Google Chrome before 42.0.2311.90 does not prevent use of a file: URL for an OpenSearch descriptor XML document, which might allow remote attackers to obtain sensitive information from local files via a crafted (1) http or (2) https web site.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having important severity.

CVSS v2 Scores
	National Vulnerability Database
Base Score	5
Vector	AV:N/AC:L/Au:N/C:P/I:N/A:N
Access Vector	Network
Access Complexity	Low
Authentication	None
Confidentiality Impact	Partial
Integrity Impact	None
Availability Impact	None

SUSE Bugzilla entry: 927302 [RESOLVED / FIXED]

SUSE Security Advisories:

openSUSE-SU-2015:0748-1 openSUSE-SU-2015:1887-1

List of released packages

Product(s)	Fixed package version(s)	References
openSUSE Leap 15.0	`chromium >= 66.0.3359.170-lp150.1.1`	Patchnames: openSUSE Leap 15.0 GA chromium-66.0.3359.170-lp150.1.1
openSUSE Leap 15.2	`chromium >= 83.0.4103.97-lp152.1.1`	Patchnames: openSUSE Leap 15.2 GA chromium-83.0.4103.97-lp152.1.1
openSUSE Leap 15.3	`chromium >= 90.0.4430.212-bp153.1.1`	Patchnames: openSUSE Leap 15.3 GA chromium-90.0.4430.212-bp153.1.1
openSUSE Leap 15.4	`chromium >= 101.0.4951.64-bp154.1.2`	Patchnames: openSUSE Leap 15.4 GA chromium-101.0.4951.64-bp154.1.2
openSUSE Tumbleweed	`chromedriver >= 55.0.2883.75-3.1` `chromium >= 55.0.2883.75-3.1` `ungoogled-chromium >= 113.0.5672.92-1.1` `ungoogled-chromium-chromedriver >= 113.0.5672.92-1.1`	Patchnames: openSUSE-Tumbleweed-2024-10171 openSUSE-Tumbleweed-2024-12948

SUSE Timeline for this CVE

CVE page created: Wed Apr 15 16:01:04 2015
CVE page last modified: Tue Sep 3 18:28:27 2024