CVE-2014-7939
First published: Thu Jan 22 2015(Updated: )
Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header.
Credit: cve-coordination@google.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google Chrome | <=40.0.2214.85 | |
| Chromium Chromium | =40.0.2214.110 | |
| Redhat Enterprise Linux Desktop Supplementary | =6.0 | |
| Redhat Enterprise Linux Server Supplementary | =6.0 | |
| Redhat Enterprise Linux Server Supplementary Eus | =6.6.z | |
| Redhat Enterprise Linux Workstation Supplementary | =6.0 | |
| openSUSE openSUSE | =13.1 | |
| openSUSE openSUSE | =13.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://googlechromereleases.blogspot.com/2015/01/stable-update.html
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00005.html
- http://rhn.redhat.com/errata/RHSA-2015-0093.html
- http://secunia.com/advisories/62383
- http://secunia.com/advisories/62665
- http://security.gentoo.org/glsa/glsa-201502-13.xml
- http://www.securityfocus.com/bid/72288
- http://www.securitytracker.com/id/1031623
- https://code.google.com/p/chromium/issues/detail?id=399951
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/author
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/google
- canonical/google chrome
- version/google chrome/40.0.2214.85
- vendor/chromium
- canonical/chromium chromium
- version/chromium chromium/40.0.2214.110
- vendor/redhat
- canonical/redhat enterprise linux desktop supplementary
- version/redhat enterprise linux desktop supplementary/6.0
- canonical/redhat enterprise linux server supplementary
- version/redhat enterprise linux server supplementary/6.0
- canonical/redhat enterprise linux server supplementary eus
- version/redhat enterprise linux server supplementary eus/6.6.z
- canonical/redhat enterprise linux workstation supplementary
- version/redhat enterprise linux workstation supplementary/6.0
- vendor/opensuse
- canonical/opensuse opensuse
- version/opensuse opensuse/13.1
- version/opensuse opensuse/13.2