medium4.3

CVE-2015-1287

Blink, as used in Google Chrome before 44.0.2403.89, enables a quirks-mode exception that limits the cases in which a Cascading Style Sheets (CSS) document is …

Impact

Blink, as used in Google Chrome before 44.0.2403.89, enables a quirks-mode exception that limits the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to core/fetch/CSSStyleSheetResource.cpp.

Affected products

Vendor	Product	Affected versions
Opensuse	Opensuse	Versions 13.1, 13.2
Google	Chrome	through 43.0.2357.134
Redhat	Enterprise Linux Desktop Supplementary	Version 6.0
Redhat	Enterprise Linux Server Supplementary	Version 6.0
Redhat	Enterprise Linux Server Supplementary Eus	Version 6.7z
Redhat	Enterprise Linux Workstation Supplementary	Version 6.0
Debian	Debian Linux	Version 8.0

Weakness classification

CWE-17

References

NVD record
CVE.org record
http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html
http://rhn.redhat.com/errata/RHSA-2015-1499.html
http://www.debian.org/security/2015/dsa-3315
http://www.securityfocus.com/bid/75973
http://www.securitytracker.com/id/1033031
https://code.google.com/p/chromium/issues/detail?id=419383
https://security.gentoo.org/glsa/201603-09
https://src.chromium.org/viewvc/blink?revision=195266&view=revision
http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html
http://rhn.redhat.com/errata/RHSA-2015-1499.html
http://www.debian.org/security/2015/dsa-3315
http://www.securityfocus.com/bid/75973
http://www.securitytracker.com/id/1033031
https://code.google.com/p/chromium/issues/detail?id=419383
https://security.gentoo.org/glsa/201603-09
https://src.chromium.org/viewvc/blink?revision=195266&view=revision