CVE-2015-1288

2015-07-2300:59:00

CWE-17

[email protected]

web.nvd.nist.gov

cve-2015-1288

spellcheck api

google chrome

https

man-in-the-middle

vulnerability

9.5 High

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

68.8%

JSON

The Spellcheck API implementation in Google Chrome before 44.0.2403.89 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file, a related issue to CVE-2015-1263.

CPENameOperatorVersion
google:chromegoogle chromele43.0.2357.134
debian:debian_linuxdebian debian linuxeq8.0
redhat:enterprise_linux_server_supplementary_eusredhat enterprise linux server supplementary euseq6.7z
redhat:enterprise_linux_desktop_supplementaryredhat enterprise linux desktop supplementaryeq6.0
redhat:enterprise_linux_server_supplementaryredhat enterprise linux server supplementaryeq6.0
redhat:enterprise_linux_workstation_supplementaryredhat enterprise linux workstation supplementaryeq6.0
opensuse:opensuseopensuseeq13.1
opensuse:opensuseopensuseeq13.2

CPE	Name	Operator	Version
google:chrome	google chrome	le	43.0.2357.134
debian:debian_linux	debian debian linux	eq	8.0
redhat:enterprise_linux_server_supplementary_eus	redhat enterprise linux server supplementary eus	eq	6.7z
redhat:enterprise_linux_desktop_supplementary	redhat enterprise linux desktop supplementary	eq	6.0
redhat:enterprise_linux_server_supplementary	redhat enterprise linux server supplementary	eq	6.0
redhat:enterprise_linux_workstation_supplementary	redhat enterprise linux workstation supplementary	eq	6.0
opensuse:opensuse	opensuse	eq	13.1
opensuse:opensuse	opensuse	eq	13.2