CVE-2013-6166
Published: 15 February 2014
Google Chrome before 29 sends HTTP Cookie headers without first validating that they have the required character-set restrictions, which allows remote attackers to conduct the equivalent of a persistent Logout CSRF attack via a crafted parameter that forces a web application to set a malformed cookie within an HTTP response.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
chromium-browser Launchpad, Ubuntu, Debian |
lucid |
Ignored
(end of life)
|
| precise |
Released
(31.0.1650.63-0ubuntu0.12.04.1~20131204.1)
|
|
| quantal |
Released
(31.0.1650.63-0ubuntu0.12.10.1~20131204.1)
|
|
| raring |
Released
(31.0.1650.63-0ubuntu0.13.04.1~20131204.1)
|
|
| saucy |
Released
(31.0.1650.63-0ubuntu0.13.10.1~20131204.1)
|
|
| upstream |
Released
(31.0.1650.48)
|