CVE-2014-7939 Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.lo...
MediumCVSS 4.3
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Google Chrome | <= 40.0.2214.85 | No fix listed |
| chromium | = 40.0.2214.110 | No fix listed |
| redhat enterprise linux desktop supplementary | = 6.0 | No fix listed |
| redhat enterprise linux server supplementary | = 6.0 | No fix listed |
| redhat enterprise linux server supplementary eus | = 6.6.z | No fix listed |
| redhat enterprise linux workstation supplementary | = 6.0 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
References
- googlechromereleases.blogspot.com
- openSUSE-SU-2015:0441 vendor-advisory
- RHSA-2015:0093 vendor-advisory
- 62383 third-party-advisory
- 62665 third-party-advisory
- GLSA-201502-13 vendor-advisory
- 72288 vdb-entry
- 1031623 vdb-entry
- code.google.com