NVD

Id
20484  
Name
CVE-2016-5145  
Description
Blink, as used in Google Chrome before 52.0.2743.116, does not ensure that a taint property is preserved after a structure-clone operation on an ImageBitmap object derived from a cross-origin image, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-08-07  
Modified Date
2016-11-28  
Seq
2016-5145  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
112099 20484 CVE-2016-5145 http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html  View
112100 20484 CVE-2016-5145 openSUSE-SU-2016:1982  View
112101 20484 CVE-2016-5145 openSUSE-SU-2016:1983  View
112102 20484 CVE-2016-5145 RHSA-2016:1580  View
112103 20484 CVE-2016-5145 92276  View
112104 20484 CVE-2016-5145 1036547  View
112105 20484 CVE-2016-5145 https://codereview.chromium.org/2096313002  View
112106 20484 CVE-2016-5145 https://codereview.chromium.org/2097393002  View
112107 20484 CVE-2016-5145 https://codereview.chromium.org/2178513002  View
112108 20484 CVE-2016-5145 https://crbug.com/623406  View
112109 20484 CVE-2016-5145 FEDORA-2016-e9798eaaa3  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
3503 JVNDB-2016-004276 Google Chrome で使用される Blink における同一生成元ポリシーを回避される脆弱性 Google Chrome で使用される Blink は、クロスオリジン画像から生成された ImageBitmap オブジェクトの taint 属性が構造化クローン操作後に保存されたものかどうかを確認しないため、同一生成元ポリシーを回避される脆弱性が存在します。 CVE-2016-5145 91651 CVE-2016-5145 20484 6.8 8.8 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004276.html 2016-08-03 2016-08-12 View