CVE

Id
91954  
CVE No.
CVE-2016-5135  
Status
Candidate  
Description
WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not consider referrer-policy information inside an HTML document during a preload request, which allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a crafted web site, as demonstrated by a "Content-Security-Policy: referrer origin-when-cross-origin" header that overrides a "<META name="referrer" content="no-referrer">" element.  
Phase
Assigned (20160531)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
788095 91954 CVE-2016-5135 CONFIRM:http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html  View
788096 91954 CVE-2016-5135 CONFIRM:https://codereview.chromium.org/1913983002  View
788097 91954 CVE-2016-5135 CONFIRM:https://crbug.com/605451  View
788098 91954 CVE-2016-5135 DEBIAN:DSA-3637  View
788099 91954 CVE-2016-5135 URL:http://www.debian.org/security/2016/dsa-3637  View
788100 91954 CVE-2016-5135 REDHAT:RHSA-2016:1485  View
788101 91954 CVE-2016-5135 URL:http://rhn.redhat.com/errata/RHSA-2016-1485.html  View
788102 91954 CVE-2016-5135 SUSE:openSUSE-SU-2016:1865  View
788103 91954 CVE-2016-5135 URL:http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00020.html  View
788104 91954 CVE-2016-5135 SUSE:openSUSE-SU-2016:1868  View
788105 91954 CVE-2016-5135 URL:http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00021.html  View
788106 91954 CVE-2016-5135 SUSE:openSUSE-SU-2016:1869  View
788107 91954 CVE-2016-5135 URL:http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00022.html  View
788108 91954 CVE-2016-5135 SUSE:openSUSE-SU-2016:1918  View
788109 91954 CVE-2016-5135 URL:http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00028.html  View
788110 91954 CVE-2016-5135 UBUNTU:USN-3041-1  View
788111 91954 CVE-2016-5135 URL:http://www.ubuntu.com/usn/USN-3041-1  View
788112 91954 CVE-2016-5135 BID:92053  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
3103 JVNDB-2016-003876 Oracle Sun Systems Products Suite の ILOM における SNMP に関する脆弱性 Oracle Sun Systems Products Suite の ILOM には、SNMP に関する処理に不備があるため、完全性、および可用性に影響のある脆弱性が存在します。 CVE-2016-5448 91954 6.4 6.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-003876.html  View