CVE-2014-7939

2015-01-2222:59:20

CWE-264

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

6.3

Confidence

Low

EPSS

0.005

Percentile

76.1%

JSON

Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an “X-Content-Type-Options: nosniff” header.

Affected configurations

Nvd

Node

googlechromeRange≤40.0.2214.85

Node

chromiumchromiumMatch40.0.2214.110

Node

redhatenterprise_linux_desktop_supplementaryMatch6.0

redhatenterprise_linux_server_supplementaryMatch6.0

redhatenterprise_linux_server_supplementary_eusMatch6.6.z

redhatenterprise_linux_workstation_supplementaryMatch6.0

Node

opensuseopensuseMatch13.1

opensuseopensuseMatch13.2

VendorProductVersionCPE
googlechrome*cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
chromiumchromium40.0.2214.110cpe:2.3:a:chromium:chromium:40.0.2214.110:*:*:*:*:*:*:*
redhatenterprise_linux_desktop_supplementary6.0cpe:2.3:o:redhat:enterprise_linux_desktop_supplementary:6.0:*:*:*:*:*:*:*
redhatenterprise_linux_server_supplementary6.0cpe:2.3:o:redhat:enterprise_linux_server_supplementary:6.0:*:*:*:*:*:*:*
redhatenterprise_linux_server_supplementary_eus6.6.zcpe:2.3:o:redhat:enterprise_linux_server_supplementary_eus:6.6.z:*:*:*:*:*:*:*
redhatenterprise_linux_workstation_supplementary6.0cpe:2.3:o:redhat:enterprise_linux_workstation_supplementary:6.0:*:*:*:*:*:*:*
opensuseopensuse13.1cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
opensuseopensuse13.2cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
google	chrome	*	cpe:2.3:a:google:chrome::::::::
chromium	chromium	40.0.2214.110	cpe:2.3:a:chromium:chromium:40.0.2214.110:::::::*
redhat	enterprise_linux_desktop_supplementary	6.0	cpe:2.3:o:redhat:enterprise_linux_desktop_supplementary:6.0:::::::*
redhat	enterprise_linux_server_supplementary	6.0	cpe:2.3:o:redhat:enterprise_linux_server_supplementary:6.0:::::::*
redhat	enterprise_linux_server_supplementary_eus	6.6.z	cpe:2.3:o:redhat:enterprise_linux_server_supplementary_eus:6.6.z:::::::*
redhat	enterprise_linux_workstation_supplementary	6.0	cpe:2.3:o:redhat:enterprise_linux_workstation_supplementary:6.0:::::::*
opensuse	opensuse	13.1	cpe:2.3:o:opensuse:opensuse:13.1:::::::*
opensuse	opensuse	13.2	cpe:2.3:o:opensuse:opensuse:13.2:::::::*