NVD

Id
38779  
Name
CVE-2013-2866  
Description
The Flash plug-in in Google Chrome before 27.0.1453.116, as used on Google Chrome OS before 27.0.1453.116 and separately, does not properly determine whether a user wishes to permit camera or microphone access by a Flash application, which allows remote attackers to obtain sensitive information from a machine"s physical environment via a clickjacking attack, as demonstrated by an attack using a crafted Cascading Style Sheets (CSS) opacity property.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-18  
Published
2013-06-19  
Modified Date
2016-10-18  
Seq
2013-2866  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
198598 38779 CVE-2013-2866 http://googlechromereleases.blogspot.com/2013/06/stable-channel-update-for-chrome-os.html  View
198599 38779 CVE-2013-2866 http://googlechromereleases.blogspot.com/2013/06/stable-channel-update_18.html  View
198600 38779 CVE-2013-2866 http://habrahabr.ru/post/182706/  View
198601 38779 CVE-2013-2866 oval:org.mitre.oval:def:16693  View
198602 38779 CVE-2013-2866 https://code.google.com/p/chromium/issues/detail?id=249335  View
198603 38779 CVE-2013-2866 https://src.chromium.org/viewvc/chrome?revision=206188&view=revision  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
21506 JVNDB-2013-003081 Google Chrome の Flash プラグインにおける重要な情報を取得される脆弱性 Google Chrome の Flash プラグインには、Flash アプリケーション対してカメラまたはマイクロフォンへのアクセスが許可されているかどうかを適切に判定しないため、マシンの物理的環境から重要な情報を取得される脆弱性が存在します。 CVE-2013-2866 62808 CVE-2013-2866 38779 4.3 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-003081.html 2013-06-18 2013-06-21 View