medium4.3
CVE-2009-3264
The getSVGDocument method in Google Chrome before 3.0.195.21 omits an unspecified "access check," which allows remote web servers to bypass the Same Origin Pol…
Impact
The getSVGDocument method in Google Chrome before 3.0.195.21 omits an unspecified "access check," which allows remote web servers to bypass the Same Origin Policy and conduct cross-site scripting attacks via unknown vectors, related to a user's visit to a different web server that hosts an SVG document.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Chrome | through 3.0.193.2 Versions 0.2.149.27, 0.2.149.29, 0.2.149.30, 0.2.152.1, 0.2.153.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://code.google.com/p/chromium/issues/detail?id=21338
- http://googlechromereleases.blogspot.com/2009/09/stable-channel-update.html
- http://osvdb.org/58193
- http://secunia.com/advisories/36770
- http://www.securityfocus.com/bid/36416
- http://code.google.com/p/chromium/issues/detail?id=21338
- http://googlechromereleases.blogspot.com/2009/09/stable-channel-update.html
- http://osvdb.org/58193
- http://secunia.com/advisories/36770
- http://www.securityfocus.com/bid/36416