FKIE_CVE-2015-1210

Vulnerability from fkie_nvd - Published: 2015-02-06 11:59 - Updated: 2025-04-12 10:46
Severity ?
Summary
The V8ThrowException::createDOMException function in bindings/core/v8/V8ThrowException.cpp in the V8 bindings in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, does not properly consider frame access restrictions during the throwing of an exception, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
References
chrome-cve-admin@google.comhttp://googlechromereleases.blogspot.com/2015/02/chrome-for-android-update.html
chrome-cve-admin@google.comhttp://googlechromereleases.blogspot.com/2015/02/stable-channel-update.html
chrome-cve-admin@google.comhttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00005.html
chrome-cve-admin@google.comhttp://rhn.redhat.com/errata/RHSA-2015-0163.html
chrome-cve-admin@google.comhttp://secunia.com/advisories/62670
chrome-cve-admin@google.comhttp://secunia.com/advisories/62818
chrome-cve-admin@google.comhttp://secunia.com/advisories/62917
chrome-cve-admin@google.comhttp://secunia.com/advisories/62925
chrome-cve-admin@google.comhttp://security.gentoo.org/glsa/glsa-201502-13.xml
chrome-cve-admin@google.comhttp://www.securityfocus.com/bid/72497
chrome-cve-admin@google.comhttp://www.securitytracker.com/id/1031709
chrome-cve-admin@google.comhttp://www.ubuntu.com/usn/USN-2495-1
chrome-cve-admin@google.comhttps://code.google.com/p/chromium/issues/detail?id=453979
chrome-cve-admin@google.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/100716
chrome-cve-admin@google.comhttps://src.chromium.org/viewvc/blink?revision=189365&view=revision
af854a3a-2127-422b-91ae-364da2661108http://googlechromereleases.blogspot.com/2015/02/chrome-for-android-update.html
af854a3a-2127-422b-91ae-364da2661108http://googlechromereleases.blogspot.com/2015/02/stable-channel-update.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00005.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-0163.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/62670
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/62818
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/62917
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/62925
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-201502-13.xml
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/72497
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1031709
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-2495-1
af854a3a-2127-422b-91ae-364da2661108https://code.google.com/p/chromium/issues/detail?id=453979
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/100716
af854a3a-2127-422b-91ae-364da2661108https://src.chromium.org/viewvc/blink?revision=189365&view=revision
Impacted products
Vendor Product Version
google chrome *
google chrome *
apple macos -
linux linux_kernel -
microsoft windows -
canonical ubuntu_linux 14.04
canonical ubuntu_linux 14.10
redhat enterprise_linux_desktop 6.0
redhat enterprise_linux_eus 6.6
redhat enterprise_linux_server 6.0
redhat enterprise_linux_server_aus 6.6
redhat enterprise_linux_workstation 6.0
opensuse opensuse 13.1
opensuse opensuse 13.2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:android:*:*",
              "matchCriteriaId": "DFDE8F2F-775A-4C8B-B332-B00E82A3BAB6",
              "versionEndExcluding": "40.0.2214.109",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "855BFB6F-F192-4D7C-A07E-8311EC8C9A4D",
              "versionEndExcluding": "40.0.2214.111",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
              "matchCriteriaId": "815D70A8-47D3-459C-A32C-9FEACA0659D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "49A63F39-30BE-443F-AF10-6245587D3359",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:6.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "319EC0C6-94C5-494A-9C5D-DC5124DFC8E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9BBCD86A-E6C7-4444-9D74-F861084090F0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "16E6D998-B41D-4B49-9E00-8336D2E40A4A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E5ED5807-55B7-47C5-97A6-03233F4FBC3A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The V8ThrowException::createDOMException function in bindings/core/v8/V8ThrowException.cpp in the V8 bindings in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, does not properly consider frame access restrictions during the throwing of an exception, which allows remote attackers to bypass the Same Origin Policy via a crafted web site."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n V8ThrowException::createDOMException en bindings/core/v8/V8ThrowException.cpp en las vinculaciones V8 en Blink, utilizado en Google Chrome anterior a 40.0.2214.111 en Windows, OS X, y Linux y anterior a 40.0.2214.109 en Android, no considera correctamente las restricciones de acceso a Frame durante el lanzamiento de una excepci\u00f3n, lo que permite a atacantes remotos evadir Same Origin Policy a trav\u00e9s de un sitio web manipulado."
    }
  ],
  "id": "CVE-2015-1210",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2015-02-06T11:59:08.433",
  "references": [
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://googlechromereleases.blogspot.com/2015/02/chrome-for-android-update.html"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://googlechromereleases.blogspot.com/2015/02/stable-channel-update.html"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00005.html"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0163.html"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://secunia.com/advisories/62670"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://secunia.com/advisories/62818"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://secunia.com/advisories/62917"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://secunia.com/advisories/62925"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://security.gentoo.org/glsa/glsa-201502-13.xml"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://www.securityfocus.com/bid/72497"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://www.securitytracker.com/id/1031709"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://www.ubuntu.com/usn/USN-2495-1"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "https://code.google.com/p/chromium/issues/detail?id=453979"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100716"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "https://src.chromium.org/viewvc/blink?revision=189365\u0026view=revision"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://googlechromereleases.blogspot.com/2015/02/chrome-for-android-update.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://googlechromereleases.blogspot.com/2015/02/stable-channel-update.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00005.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0163.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/62670"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/62818"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/62917"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/62925"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.gentoo.org/glsa/glsa-201502-13.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/72497"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1031709"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-2495-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://code.google.com/p/chromium/issues/detail?id=453979"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100716"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://src.chromium.org/viewvc/blink?revision=189365\u0026view=revision"
    }
  ],
  "sourceIdentifier": "chrome-cve-admin@google.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.