VulnerabilityModified
CVE-2014-3160
The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the…
MEDIUM 6.8EPSS 1.34%
Does this matter?
Lower severity and a low EPSS score (1.34%). Track it; it rarely justifies an emergency change on its own.
Description
The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a crafted file.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 1.34% probability · 70th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- debian/debian linux · google/chrome
- Source
- chrome-cve-admin@google.com
References
- http://googlechromereleases.blogspot.com/2014/07/stable-channel-update.html
- http://secunia.com/advisories/60061
- http://secunia.com/advisories/60372
- http://security.gentoo.org/glsa/glsa-201408-16.xml
- http://www.debian.org/security/2014/dsa-3039
- http://www.securityfocus.com/bid/68677
- https://code.google.com/p/chromium/issues/detail?id=380885
- https://src.chromium.org/viewvc/blink?revision=176084&view=revision
- http://googlechromereleases.blogspot.com/2014/07/stable-channel-update.html
- http://secunia.com/advisories/60061
- http://secunia.com/advisories/60372
- http://security.gentoo.org/glsa/glsa-201408-16.xml
- http://www.debian.org/security/2014/dsa-3039
- http://www.securityfocus.com/bid/68677
- https://code.google.com/p/chromium/issues/detail?id=380885
- https://src.chromium.org/viewvc/blink?revision=176084&view=revision
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.