NVD

Id
23660  
Name
CVE-2015-1300  
Description
The FrameFetchContext::updateTimingInfoForIFrameNavigation function in core/loader/FrameFetchContext.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to obtain sensitive information via crafted JavaScript code that leverages a history.back call.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2015-09-03  
Modified Date
2016-12-21  
Seq
2015-1300  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
125811 23660 CVE-2015-1300 http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html  View
125812 23660 CVE-2015-1300 openSUSE-SU-2015:1586  View
125813 23660 CVE-2015-1300 openSUSE-SU-2015:1873  View
125814 23660 CVE-2015-1300 RHSA-2015:1712  View
125815 23660 CVE-2015-1300 DSA-3351  View
125816 23660 CVE-2015-1300 1033472  View
125817 23660 CVE-2015-1300 https://code.google.com/p/chromium/issues/detail?id=511616  View
125818 23660 CVE-2015-1300 https://github.com/w3c/resource-timing/issues/29  View
125819 23660 CVE-2015-1300 GLSA-201603-09  View
125820 23660 CVE-2015-1300 https://src.chromium.org/viewvc/blink?revision=199553&view=revision  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
9253 JVNDB-2015-004573 Google Chrome で使用される Blink の core/loader/FrameFetchContext.cpp における重要な情報を取得される脆弱性 Google Chrome で使用される Blink の core/loader/FrameFetchContext.cpp の FrameFetchContext::updateTimingInfoForIFrameNavigation 関数は、IFRAME Resource Timing API の時間の使用可能量を適切に制限しないため、重要な情報を取得される脆弱性脆弱性が存在します。 CVE-2015-1300 78525 CVE-2015-1300 23660 5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-004573.html 2015-09-01 2015-09-07 View