CVE-2015-6783

EPSS 0.25%
Veröffentlicht 06.12.2015 01:59:20
Zuletzt bearbeitet 12.04.2025 10:46:40
Quelle chrome-cve-admin@google.com
CVE-Watchlists
Login
Unerledigt
Login

The FindStartOffsetOfFileInZipFile function in crazy_linker_zip.cpp in crazy_linker (aka Crazy Linker) in Android 5.x and 6.x, as used in Google Chrome before 47.0.2526.73, improperly searches for an EOCD record, which allows attackers to bypass a signature-validation requirement via a crafted ZIP archive.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 11

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Google ≫ Android Version5.0

Google ≫ Chrome Version <= 46.0.2490.86

Google ≫ Android Version6.0

Google ≫ Chrome Version <= 46.0.2490.86

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.25%	0.485

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://security.gentoo.org/glsa/201603-09

http://googlechromereleases.blogspot.com/2015/12/stable-channel-update.html

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00016.html

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00017.html

http://www.securitytracker.com/id/1034298

http://www.securityfocus.com/bid/78416

https://chromium.googlesource.com/chromium/src.git/+/d9e316238aee59acf665d80b544cf4e1edfd3349

https://code.google.com/p/chromium/issues/detail?id=537205

https://nvd.nist.gov/vuln/detail/CVE-2015-6783

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-6783

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-6783

EUVD