CVE-2015-1244

2015-04-1900:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.006 Low

EPSS

Percentile

78.2%

JSON

The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in
Google Chrome before 42.0.2311.90 does not replace the ws scheme with the
wss scheme whenever an HSTS Policy is active, which makes it easier for
remote attackers to obtain sensitive information by sniffing the network
for WebSocket traffic.

OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchchromium-browser< 43.0.2357.81-0ubuntu0.14.04.1.1089UNKNOWN
ubuntu14.10noarchchromium-browser< 43.0.2357.81-0ubuntu0.14.10.1.1131UNKNOWN
ubuntu15.04noarchchromium-browser< 43.0.2357.81-0ubuntu0.15.04.1.1170UNKNOWN
ubuntu15.10noarchchromium-browser< 43.0.2357.81-0ubuntu1.1179UNKNOWN
ubuntu14.04noarchoxide-qt< 1.6.5-0ubuntu0.14.04.1UNKNOWN
ubuntu14.10noarchoxide-qt< 1.6.5-0ubuntu0.14.10.1UNKNOWN
ubuntu15.04noarchoxide-qt< 1.6.5-0ubuntu0.15.04.1UNKNOWN
ubuntu15.10noarchoxide-qt< 1.7.7-0ubuntu0.15.04.1~ppa1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	14.04	noarch	chromium-browser	< 43.0.2357.81-0ubuntu0.14.04.1.1089	UNKNOWN
ubuntu	14.10	noarch	chromium-browser	< 43.0.2357.81-0ubuntu0.14.10.1.1131	UNKNOWN
ubuntu	15.04	noarch	chromium-browser	< 43.0.2357.81-0ubuntu0.15.04.1.1170	UNKNOWN
ubuntu	15.10	noarch	chromium-browser	< 43.0.2357.81-0ubuntu1.1179	UNKNOWN
ubuntu	14.04	noarch	oxide-qt	< 1.6.5-0ubuntu0.14.04.1	UNKNOWN
ubuntu	14.10	noarch	oxide-qt	< 1.6.5-0ubuntu0.14.10.1	UNKNOWN
ubuntu	15.04	noarch	oxide-qt	< 1.6.5-0ubuntu0.15.04.1	UNKNOWN
ubuntu	15.10	noarch	oxide-qt	< 1.7.7-0ubuntu0.15.04.1~ppa1	UNKNOWN