CVE-2015-1288: Medium severity google chrome vulnerability
The Spellcheck API implementation in Google Chrome before 44.0.2403.89 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file, a related issue to CVE-2015-1263.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1288?
CVE-2015-1288 is classified as a high severity vulnerability due to its potential for man-in-the-middle attacks.
How do I fix CVE-2015-1288?
To fix CVE-2015-1288, ensure you update Google Chrome to version 44.0.2403.89 or later.
What systems are affected by CVE-2015-1288?
CVE-2015-1288 affects various versions of Google Chrome and several distributions of Linux, including Debian and Red Hat.
What type of attack does CVE-2015-1288 enable?
CVE-2015-1288 enables man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly inject malicious content.
Is there a workaround for CVE-2015-1288 if I cannot update?
There are no known workarounds for CVE-2015-1288 other than applying the necessary updates to the affected software.