Access Restriction Bypass Affecting chromium-browser package, versions <17.0.963.56~r121963-1


Severity

Recommended
0.0
medium
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.36% (72nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN8-CHROMIUMBROWSER-414391
  • published7 Dec 2011
  • disclosed7 Dec 2011

Introduced: 7 Dec 2011

CVE-2011-4691  (opens in a new tab)
CWE-264  (opens in a new tab)

How to fix?

Upgrade Debian:8 chromium-browser to version 17.0.963.56~r121963-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream chromium-browser package and not the chromium-browser package as distributed by Debian. See How to fix? for Debian:8 relevant fixed versions and status.

Google Chrome 15.0.874.121 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code.

CVSS Scores

version 3.1