Upstream information

CVE-2015-1267 at MITRE

Description

Blink, as used in Google Chrome before 43.0.2357.130, does not properly restrict the creation context during creation of a DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that uses a Blink public API, related to WebArrayBufferConverter.cpp, WebBlob.cpp, WebDOMError.cpp, and WebDOMFileSystem.cpp.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having moderate severity.

CVSS v2 Scores
	National Vulnerability Database
Base Score	5
Vector	AV:N/AC:L/Au:N/C:N/I:P/A:N
Access Vector	Network
Access Complexity	Low
Authentication	None
Confidentiality Impact	None
Integrity Impact	Partial
Availability Impact	None

SUSE Bugzilla entry: 935723 [RESOLVED / FIXED]

SUSE Security Advisories:

openSUSE-SU-2015:1146-1 openSUSE-SU-2015:1872-1

List of released packages

Product(s)	Fixed package version(s)	References
openSUSE Leap 15.0	`chromium >= 66.0.3359.170-lp150.1.1`	Patchnames: openSUSE Leap 15.0 GA chromium-66.0.3359.170-lp150.1.1
openSUSE Leap 15.2	`chromium >= 83.0.4103.97-lp152.1.1`	Patchnames: openSUSE Leap 15.2 GA chromium-83.0.4103.97-lp152.1.1
openSUSE Leap 15.3	`chromium >= 90.0.4430.212-bp153.1.1`	Patchnames: openSUSE Leap 15.3 GA chromium-90.0.4430.212-bp153.1.1
openSUSE Leap 15.4	`chromium >= 101.0.4951.64-bp154.1.2`	Patchnames: openSUSE Leap 15.4 GA chromium-101.0.4951.64-bp154.1.2
openSUSE Tumbleweed	`chromedriver >= 55.0.2883.75-3.1` `chromium >= 55.0.2883.75-3.1` `ungoogled-chromium >= 113.0.5672.92-1.1` `ungoogled-chromium-chromedriver >= 113.0.5672.92-1.1`	Patchnames: openSUSE-Tumbleweed-2024-10171 openSUSE-Tumbleweed-2024-12948

SUSE Timeline for this CVE

CVE page created: Tue Jun 23 07:49:11 2015
CVE page last modified: Tue Sep 3 18:28:43 2024