CVE-2016-7152: Infoleak
First published: Tue Sep 06 2016(Updated: )
The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Opera Opera | ||
| Apple Safari | ||
| Mozilla Firefox | ||
| Microsoft Edge | ||
| Microsoft Internet Explorer | ||
| Google Chrome |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://arstechnica.com/security/2016/08/new-attack-steals-ssns-e-mail-addresses-and-more-from-https-pages/
- http://www.securityfocus.com/bid/92769
- http://www.securitytracker.com/id/1036741
- http://www.securitytracker.com/id/1036742
- http://www.securitytracker.com/id/1036743
- http://www.securitytracker.com/id/1036744
- http://www.securitytracker.com/id/1036745
- http://www.securitytracker.com/id/1036746
- https://tom.vg/papers/heist_blackhat2016.pdf
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/description
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/opera
- canonical/opera opera
- vendor/apple
- canonical/apple safari
- vendor/mozilla
- canonical/mozilla firefox
- vendor/microsoft
- canonical/microsoft edge
- canonical/microsoft internet explorer
- vendor/google
- canonical/google chrome