CVE

Id
78577  
CVE No.
CVE-2015-1300  
Status
Candidate  
Description
The FrameFetchContext::updateTimingInfoForIFrameNavigation function in core/loader/FrameFetchContext.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to obtain sensitive information via crafted JavaScript code that leverages a history.back call.  
Phase
Assigned (20150121)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
717779 78577 CVE-2015-1300 MISC:https://github.com/w3c/resource-timing/issues/29  View
717780 78577 CVE-2015-1300 CONFIRM:http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html  View
717781 78577 CVE-2015-1300 CONFIRM:https://code.google.com/p/chromium/issues/detail?id=511616  View
717782 78577 CVE-2015-1300 CONFIRM:https://src.chromium.org/viewvc/blink?revision=199553&view=revision  View
717783 78577 CVE-2015-1300 DEBIAN:DSA-3351  View
717784 78577 CVE-2015-1300 URL:http://www.debian.org/security/2015/dsa-3351  View
717785 78577 CVE-2015-1300 GENTOO:GLSA-201603-09  View
717786 78577 CVE-2015-1300 URL:https://security.gentoo.org/glsa/201603-09  View
717787 78577 CVE-2015-1300 REDHAT:RHSA-2015:1712  View
717788 78577 CVE-2015-1300 URL:http://rhn.redhat.com/errata/RHSA-2015-1712.html  View
717789 78577 CVE-2015-1300 SUSE:openSUSE-SU-2015:1873  View
717790 78577 CVE-2015-1300 URL:http://lists.opensuse.org/opensuse-updates/2015-11/msg00013.html  View
717791 78577 CVE-2015-1300 SUSE:openSUSE-SU-2015:1586  View
717792 78577 CVE-2015-1300 URL:http://lists.opensuse.org/opensuse-updates/2015-09/msg00029.html  View
717793 78577 CVE-2015-1300 SECTRACK:1033472  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
6684 JVNDB-2015-002004 PHP の PostgreSQL エクステンションにおけるサービス運用妨害 (DoS) の脆弱性 PHP の PostgreSQL (別名 pgsql) エクステンションの pgsql.c 内の build_tablename 関数は、テーブル名のトークンの抽出を検証しないため、サービス運用妨害 (NULL ポインタデリファレンスおよびアプリケーションクラッシュ) 状態にされる脆弱性が存在します。 CVE-2015-1352 78577 5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-002004.html  View