CVE-2015-1211
Published: 6 February 2015
The OriginCanAccessServiceWorkers function in content/browser/service_worker/service_worker_dispatcher_host.cc in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android does not properly restrict the URI scheme during a ServiceWorker registration, which allows remote attackers to gain privileges via a filesystem: URI.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
chromium-browser Launchpad, Ubuntu, Debian |
lucid |
Ignored
(end of life)
|
| precise |
Ignored
|
|
| trusty |
Released
(40.0.2214.111-0ubuntu0.14.04.1.1069)
|
|
| upstream |
Released
(40.0.2214.111)
|
|
| utopic |
Released
(40.0.2214.111-0ubuntu0.14.10.1.1111)
|
|
| vivid |
Released
(40.0.2214.111-0ubuntu1.1121)
|
|
| wily |
Released
(40.0.2214.111-0ubuntu1.1121)
|
|
|
oxide-qt Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
| precise |
Does not exist
|
|
| trusty |
Released
(1.4.3-0ubuntu0.14.04.1)
|
|
| upstream |
Released
(1.4.3)
|
|
| utopic |
Released
(1.4.3-0ubuntu0.14.10.1)
|
|
| vivid |
Released
(1.5.3-0ubuntu2)
|
|
| wily |
Released
(1.5.3-0ubuntu2)
|
References
- https://codereview.chromium.org/889323002
- https://code.google.com/p/chromium/issues/detail?id=453982
- http://googlechromereleases.blogspot.com/2015/02/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2015/02/chrome-for-android-update.html
- https://ubuntu.com/security/notices/USN-2495-1
- https://www.cve.org/CVERecord?id=CVE-2015-1211
- NVD
- Launchpad
- Debian