CVE-2014-7948 — Google Chrome vulnerability

CWE-3107 documents6 sources
Severity
4.3MEDIUMNVD
OSV7.5
EPSS
0.6%
top 31.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Google Chrome
Timeline
PublishedJan 22
Latest updateMay 17

Description

The AppCacheUpdateJob::URLFetcher::OnResponseStarted function in content/browser/appcache/appcache_update_job.cc in Google Chrome before 40.0.2214.91 proceeds with AppCache caching for SSL sessions even if there is an X.509 certificate error, which allows man-in-the-middle attackers to spoof HTML5 application content via a crafted certificate.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDgoogle/chrome40.0.2214.85

🔴Vulnerability Details

3
GHSA
GHSA-7v79-m7r5-h737: The AppCacheUpdateJob::URLFetcher::OnResponseStarted function in content/browser/appcache/appcache_update_job↗2022-05-17
▶
OSV
oxide-qt vulnerabilities↗2015-01-26
▶
OSV
CVE-2014-7948: The AppCacheUpdateJob::URLFetcher::OnResponseStarted function in content/browser/appcache/appcache_update_job↗2015-01-22
▶

📋Vendor Advisories

2
Ubuntu
Oxide vulnerabilities↗2015-01-26
▶
Red Hat
chromium-browser: caching error in AppCache↗2015-01-21
▶

💬Community

1
Bugzilla
CVE-2014-7948 chromium-browser: caching error in AppCache↗2015-01-23
▶