KLA10893 Multiple vulnerabilities in Yandex browser

Multiple serious vulnerabilities have been found in Yandex Browser. Malicious users can exploit these vulnerabilities to inject arbitrary code or obtain sensitive information.

Below is a complete list of vulnerabilities

1. Cross-site scripting vulnerabilities at Translator and BookReader can be exploited to inject arbitrary JavaScript code;
2. CSRF vulnerability at synchronization form can be exploited to obtain sensitive information;
3. An unknown vulnerability at Anti-phishing warning can be exploited remotely to brute-force passwords via injected JavaScript;
4. An unknown vulnerability at Security WiFi can be exploited remotely to obtain sensitive information.

Technical details

Vulnerability (2) can be exploited to steal data saved in browser profile.

Vulnerability (4) can be exploited to sniff traffic from open or protected wi-fi networks.

Original advisories

Yandex Browser changelogs

Related products

Yandex-Browser

CVE list

CVE-2016-8506 warning

CVE-2016-8505 warning

CVE-2016-8504 warning

CVE-2016-8503 warning

CVE-2016-8502 warning

CVE-2016-8501 warning

Solution

Update to the latest version

Get Yandex Browser

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• CI

Code injection. Exploitation of vulnerabilities with this impact can lead to changes in target code.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• Yandex Browser versions earlier than 16.9 excluding version 16.7