Apple Patches Keynote, Mozilla Patches Firefox

Apple on Thursday patched a handful of vulnerabilities in several iterations of its Keynote, Pages, Numbers and iWork productivity software. The most serious of the security flaws allow an attacker to execute code on a compromised OS X computer running Yosemite 10.10.4 or later, or iOS 8.4 or lat...

USN-2768-1 firefox vulnerability

Abdulrahman Alqabandi and Ben Kelly discovered that the fetch API did not correctly implement the Cross Origin Resource Sharing CORS specification. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information from oth...

firefox: cross-origin restriction bypass

Security researcher Abdulrahman Alqabandi reported that the fetch API did not correctly implement the Cross-Origin Resource Sharing CORS specification, allowing a malicious page to access private data from other origins. Mozilla developer Ben Kelly independently reported the same issue...

Firefox < 41.0.2 'fetch' API Cross-Origin Bypass (Mac OS X)

The version of Firefox installed on the remote Mac OS X host is prior to 41.0.2. It is, therefore, affected by a cross-origin restriction bypass vulnerability in the fetch API due to an incorrect implementation of the Cross-Origin Resource Sharing CORS specification. A remote attacker can exploit...

Firefox < 41.0.2 'fetch' API Cross-Origin Bypass

The version of Firefox installed on the remote Windows host is prior to 41.0.2. It is, therefore, affected by a cross-origin restriction bypass vulnerability in the fetch API due to an incorrect implementation of the Cross-Origin Resource Sharing CORS specification. A remote attacker can exploit...

Ubuntu: Security Advisory (USN-2768-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

chromium-browser: cross-origin bypass in Blink

The ContainerNode::parserInsertBefore function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 46.0.2490.71, proceeds with a DOM tree insertion in certain cases where a parent node no longer contains a child node, which allows remote attackers to bypass the Same Origin...

CVE-2015-6762

The CSSFontFaceSrcValue::fetch function in core/css/CSSFontFaceSrcValue.cpp in the Cascading Style Sheets CSS implementation in Blink, as used in Google Chrome before 46.0.2490.71, does not use the CORS cross-origin request algorithm when a font's URL appears to be a same-origin URL, which allows...

CVE-2015-6762

CVE-2015-6762 affects Chromium/Google Chrome engines prior to 46.0.2490.71. The vulnerability lies in the CSSFontFaceSrcValue::fetch path in Blink’s CSS font loading, where the CORS cross-origin request algorithm is not used for fonts with seemingly same-origin URLs, allowing a remote server to b...

UBUNTU-CVE-2015-6762

The CSSFontFaceSrcValue::fetch function in core/css/CSSFontFaceSrcValue.cpp in the Cascading Style Sheets CSS implementation in Blink, as used in Google Chrome before 46.0.2490.71, does not use the CORS cross-origin request algorithm when a font's URL appears to be a same-origin URL, which allows...

CVE-2015-6762

The CSSFontFaceSrcValue::fetch function in core/css/CSSFontFaceSrcValue.cpp in the Cascading Style Sheets CSS implementation in Blink, as used in Google Chrome before 46.0.2490.71, does not use the CORS cross-origin request algorithm when a font's URL appears to be a same-origin URL, which allows...

Cross-origin restriction bypass using Fetch — Mozilla

Security researcher Abdulrahman Alqabandi reported that the fetch API did not correctly implement the Cross-Origin Resource Sharing CORS specification, allowing a malicious page to access private data from other origins. Mozilla developer Ben Kelly independently reported the same issue...

chromium: multiple issues

CVE-2015-6755 cross-origin bypass: Cross-origin bypass in Blink. Credit to Mariusz Mlynski. - CVE-2015-6756 use-after-free: Use-after-free in PDFium. - CVE-2015-6757 use-after-free: Use-after-free in ServiceWorker. Credit to Collin Payne. - CVE-2015-6758: Bad-cast in PDFium. Credit to Atte...

Google Chrome < 46.0.2490.71 Multiple Vulnerabilities (Mac OS X)

The version of Google Chrome installed on the remote Mac OS X host is prior to 46.0.2490.71. It is, therefore, affected by multiple vulnerabilities : - A same-origin bypass vulnerability exists in Blink that allows an attacker to bypass the same-origin policy. CVE-2015-6755 - A use-after-free err...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 24 security fixes in this release, including: 519558 High CVE-2015-6755: Cross-origin bypass in Blink. Credit to Mariusz Mlynski. 507316 High CVE-2015-6756: Use-after-free in PDFium. Credit to anonymous. 529520 High CVE-2015-6757: Use-after-free in ServiceWorker...

Security update for Chromium (important)

Chromium was updated to 45.0.2454.101 to fix two security issues. The following vulnerabilities were fixed: CVE-2015-1303: Cross-origin bypass in DOM boo947504 CVE-2015-1304: Cross-origin bypass in V8 boo947507...

Vulnerability of Firefox and Firefox ESR browsers, which allows attackers to bypass the CORS protection mechanism

The vulnerability of Firefox and Firefox ESR browsers is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass the CORS protection mechanism by duplicating cookie sequence keys or extracting values from the response header of an incorrect HTTP...

MGASA-2015-0389 Updated chromium-browser packages fix security vulnerabilities

Updated chromium-browser-stable packages fix security vulnerabilities: Two flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to bypass cross origin restrictions, and access or modify data from an unrelated web site...

Google Chrome DOM Cross-Origin Bypass Vulnerability

Google Chrome is an open source WEB browser. A cross-origin security control bypass vulnerability exists in the Google Chrome DOM, which allows remote attackers to exploit the vulnerability to bypass security restrictions...

Google Chrome V8 Engine Cross-Origin Bypass Vulnerability

Google Chrome is an open source WEB browser. A cross-origin security control bypass vulnerability exists in the Google Chrome V8 engine, which allows remote attackers to exploit the vulnerability to bypass security restrictions...