The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a crafted file.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 02:07
Type | Values Removed | Values Added |
---|---|---|
References | () http://googlechromereleases.blogspot.com/2014/07/stable-channel-update.html - | |
References | () http://secunia.com/advisories/60061 - | |
References | () http://secunia.com/advisories/60372 - | |
References | () http://security.gentoo.org/glsa/glsa-201408-16.xml - | |
References | () http://www.debian.org/security/2014/dsa-3039 - | |
References | () http://www.securityfocus.com/bid/68677 - | |
References | () https://code.google.com/p/chromium/issues/detail?id=380885 - | |
References | () https://src.chromium.org/viewvc/blink?revision=176084&view=revision - |
07 Nov 2023, 02:19
Type | Values Removed | Values Added |
---|---|---|
References | () https://src.chromium.org/viewvc/blink?revision=176084&view=revision - | |
References | () http://www.debian.org/security/2014/dsa-3039 - | |
References | () http://secunia.com/advisories/60372 - | |
References | () http://googlechromereleases.blogspot.com/2014/07/stable-channel-update.html - | |
References | () http://secunia.com/advisories/60061 - | |
References | () https://code.google.com/p/chromium/issues/detail?id=380885 - | |
References | () http://security.gentoo.org/glsa/glsa-201408-16.xml - | |
References | () http://www.securityfocus.com/bid/68677 - |
Information
Published : 2014-07-20 11:12
Updated : 2024-11-21 02:07
NVD link : CVE-2014-3160
Mitre link : CVE-2014-3160
CVE.ORG link : CVE-2014-3160
JSON object : View
Products Affected
- chrome
debian
- debian_linux
CWE
CWE-264
Permissions, Privileges, and Access Controls