CVE-2016-7152: Infoleak
The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7152?
CVE-2016-7152 is classified as a high severity vulnerability due to its potential to allow attackers to obtain sensitive data.
How do I fix CVE-2016-7152?
To mitigate CVE-2016-7152, users should update their web browsers to the latest versions as they include patches for this vulnerability.
What browsers are affected by CVE-2016-7152?
CVE-2016-7152 affects several browsers including Opera, Apple Mobile Safari, Mozilla Firefox, Microsoft Edge, Internet Explorer, and Google Chrome.
What type of attack does CVE-2016-7152 facilitate?
CVE-2016-7152 facilitates a HEIST attack, which can be used to extract cleartext data from HTTPS pages.
Can CVE-2016-7152 be exploited remotely?
Yes, CVE-2016-7152 can be exploited remotely if the specific browser configurations are in place.