CVE-2015-1241

Google Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation with the handling of touch events and gesture events, which allows remote attackers to trigger unintended UI actions via a crafted web site that conducts a "tapjacking" attack.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://codereview.chromium.org/660663002
https://codereview.chromium.org/868123002
https://code.google.com/p/chromium/issues/detail?id=418402
http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html	Vendor Advisory
https://codereview.chromium.org/717573004
https://codereview.chromium.org/628763003
http://ubuntu.com/usn/usn-2570-1
http://www.debian.org/security/2015/dsa-3238
http://www.securitytracker.com/id/1032209
http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
https://security.gentoo.org/glsa/201506-04
http://rhn.redhat.com/errata/RHSA-2015-0816.html
http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:15.04:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:14.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::

Information

Published : 2015-04-19 10:59

Updated : 2017-01-03 02:59

NVD link : CVE-2015-1241

Mitre link : CVE-2015-1241

JSON object : View

Products Affected

canonical

ubuntu_linux

debian

debian_linux

google

chrome

CWE

CWE-20

Improper Input Validation

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://codereview.chromium.org/660663002", "name": "https://codereview.chromium.org/660663002", "tags": [], "refsource": "CONFIRM"}, {"url": "https://codereview.chromium.org/868123002", "name": "https://codereview.chromium.org/868123002", "tags": [], "refsource": "CONFIRM"}, {"url": "https://code.google.com/p/chromium/issues/detail?id=418402", "name": "https://code.google.com/p/chromium/issues/detail?id=418402", "tags": [], "refsource": "CONFIRM"}, {"url": "http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html", "name": "http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://codereview.chromium.org/717573004", "name": "https://codereview.chromium.org/717573004", "tags": [], "refsource": "CONFIRM"}, {"url": "https://codereview.chromium.org/628763003", "name": "https://codereview.chromium.org/628763003", "tags": [], "refsource": "CONFIRM"}, {"url": "http://ubuntu.com/usn/usn-2570-1", "name": "USN-2570-1", "tags": [], "refsource": "UBUNTU"}, {"url": "http://www.debian.org/security/2015/dsa-3238", "name": "DSA-3238", "tags": [], "refsource": "DEBIAN"}, {"url": "http://www.securitytracker.com/id/1032209", "name": "1032209", "tags": [], "refsource": "SECTRACK"}, {"url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html", "name": "openSUSE-SU-2015:1887", "tags": [], "refsource": "SUSE"}, {"url": "https://security.gentoo.org/glsa/201506-04", "name": "GLSA-201506-04", "tags": [], "refsource": "GENTOO"}, {"url": "http://rhn.redhat.com/errata/RHSA-2015-0816.html", "name": "RHSA-2015:0816", "tags": [], "refsource": "REDHAT"}, {"url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html", "name": "openSUSE-SU-2015:0748", "tags": [], "refsource": "SUSE"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Google Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation with the handling of touch events and gesture events, which allows remote attackers to trigger unintended UI actions via a crafted web site that conducts a \"tapjacking\" attack."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-20"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2015-1241", "ASSIGNER": "security@google.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2015-04-19T10:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "42.0.2311.60"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-01-03T02:59Z"}