NVD

Id
20474  
Name
CVE-2016-5135  
Description
WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not consider referrer-policy information inside an HTML document during a preload request, which allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a crafted web site, as demonstrated by a "Content-Security-Policy: referrer origin-when-cross-origin" header that overrides a "<META name="referrer" content="no-referrer">" element.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2016-07-23  
Modified Date
2016-11-28  
Seq
2016-5135  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
112001 20474 CVE-2016-5135 http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html  View
112002 20474 CVE-2016-5135 openSUSE-SU-2016:1865  View
112003 20474 CVE-2016-5135 openSUSE-SU-2016:1868  View
112004 20474 CVE-2016-5135 openSUSE-SU-2016:1869  View
112005 20474 CVE-2016-5135 openSUSE-SU-2016:1918  View
112006 20474 CVE-2016-5135 RHSA-2016:1485  View
112007 20474 CVE-2016-5135 DSA-3637  View
112008 20474 CVE-2016-5135 92053  View
112009 20474 CVE-2016-5135 USN-3041-1  View
112010 20474 CVE-2016-5135 https://codereview.chromium.org/1913983002  View
112011 20474 CVE-2016-5135 https://crbug.com/605451  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
3233 JVNDB-2016-004006 Google Chrome で使用される Blink の WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp における CSP 保護メカニズムを回避される脆弱性 Google Chrome で使用される Blink の WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp は、プリロードのリクエストの際、HTML ドキュメント内のリファラポリシー情報を考慮しないため、コンテンツセキュリティポリシー (CSP) 保護メカニズムを回避される脆弱性が存在します。 CVE-2016-5135 91641 CVE-2016-5135 20474 4.3 6.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004006.html 2016-07-20 2016-07-28 View