4.3

CVE-2014-7939

EPSS 0.69%
Published 22.01.2015 22:59:20
Last modified 12.04.2025 10:46:40
Source chrome-cve-admin@google.com
Teams watchlist Login
Open Login

Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header.

Affected products Warnungen 0 Metrics 2 CWE 0 References 12

Data is provided by the National Vulnerability Database (NVD)

Google ≫ Chrome Version <= 40.0.2214.85

Chromium ≫ Chromium Version40.0.2214.110

Redhat ≫ Enterprise Linux Desktop Supplementary Version6.0

Redhat ≫ Enterprise Linux Server Supplementary Version6.0

Redhat ≫ Enterprise Linux Server Supplementary Eus Version6.6.z

Redhat ≫ Enterprise Linux Workstation Supplementary Version6.0

Opensuse ≫ Opensuse Version13.1

Opensuse ≫ Opensuse Version13.2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.69%	0.709

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:P/A:N

http://googlechromereleases.blogspot.com/2015/01/stable-update.html

http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00005.html

http://rhn.redhat.com/errata/RHSA-2015-0093.html

http://secunia.com/advisories/62383

http://secunia.com/advisories/62665

http://security.gentoo.org/glsa/glsa-201502-13.xml

http://www.securityfocus.com/bid/72288

http://www.securitytracker.com/id/1031623

https://code.google.com/p/chromium/issues/detail?id=399951

https://nvd.nist.gov/vuln/detail/CVE-2014-7939

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2014-7939

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2014-7939

EUVD