Ubuntu.comUB:CVE-2014-3172CVE-2014-3172
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
0.003 Low
EPSS
Percentile
69.3%
The Debugger extension API in
browser/extensions/api/debugger/debugger_api.cc in Google Chrome before
37.0.2062.94 does not validate a tab’s URL before an attach operation,
which allows remote attackers to bypass intended access limitations via an
extension that uses a restricted URL, as demonstrated by a chrome:// URL.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 12.04 | noarch | chromium-browser | < 37.0.2062.94-0ubuntu0.12.04.1~pkg909 | UNKNOWN |
| ubuntu | 14.04 | noarch | chromium-browser | < 37.0.2062.94-0ubuntu0.14.04.1~pkg1042 | UNKNOWN |
References
googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
crbug.com/367567
launchpad.net/bugs/cve/CVE-2014-3172
nvd.nist.gov/vuln/detail/CVE-2014-3172
security-tracker.debian.org/tracker/CVE-2014-3172
src.chromium.org/viewvc/chrome?revision=280354&view=revision
www.cve.org/CVERecord?id=CVE-2014-3172
Related
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
0.003 Low
EPSS
Percentile
69.3%