CVE-2015-1244
published 2015-04-19CVE-2015-1244: The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme…
PriorityP421medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
1.44%
70.5th percentile
The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for WebSocket traffic.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| chrome | <= 42.0.2311.60 | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.0MEDIUM
vendor_redhat5.0MEDIUM
vendor_ubuntu5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Oxide vulnerabilities
vendor_ubuntu·2015-04-27·CVSS 5.0
CVE-2015-1235 [MEDIUM] Oxide vulnerabilities
Title: Oxide vulnerabilities
Summary: Several security issues were fixed in Oxide.
An issue was discovered in the HTML parser in Blink. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to bypass same-origin restrictions.
(CVE-2015-1235)
An issue was discovered in the Web Audio API implementation in Blink. If
a user were tricked in to opening a specially crafted website, an attacker
could potentially exploit this to bypass same-origin restrictions.
(CVE-2015-1236)
A use-after-free was discovered in Chromium. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to cause a denial of service via renderer crash, or execute arbitrary
code with the privileges of the sandboxed re
Red Hat
chromium-browser: HSTS bypass in WebSockets
vendor_redhat·2015-04-14·CVSS 5.0
CVE-2015-1244 [MEDIUM] CWE-305 chromium-browser: HSTS bypass in WebSockets
chromium-browser: HSTS bypass in WebSockets
The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for WebSocket traffic.
GHSA
GHSA-g86g-ggjj-ppxm: The URLRequest::GetHSTSRedirect function in url_request/url_request
ghsa_unreviewed·2022-05-17
CVE-2015-1244 [MEDIUM] CWE-200 GHSA-g86g-ggjj-ppxm: The URLRequest::GetHSTSRedirect function in url_request/url_request
The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for WebSocket traffic.
OSV
oxide-qt vulnerabilities
osv·2015-04-27·CVSS 5.0
CVE-2015-1235 [MEDIUM] oxide-qt vulnerabilities
oxide-qt vulnerabilities
An issue was discovered in the HTML parser in Blink. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to bypass same-origin restrictions.
(CVE-2015-1235)
An issue was discovered in the Web Audio API implementation in Blink. If
a user were tricked in to opening a specially crafted website, an attacker
could potentially exploit this to bypass same-origin restrictions.
(CVE-2015-1236)
A use-after-free was discovered in Chromium. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to cause a denial of service via renderer crash, or execute arbitrary
code with the privileges of the sandboxed render process. (CVE-2015-1237)
An out-of-bounds write was d
OSV
CVE-2015-1244: The URLRequest::GetHSTSRedirect function in url_request/url_request
osv·2015-04-19·CVSS 5.0
CVE-2015-1244 [MEDIUM] CVE-2015-1244: The URLRequest::GetHSTSRedirect function in url_request/url_request
The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for WebSocket traffic.
No detection rules found.
No public exploits indexed.
http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.htmlhttp://lists.opensuse.org/opensuse-updates/2015-04/msg00040.htmlhttp://lists.opensuse.org/opensuse-updates/2015-11/msg00024.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0816.htmlhttp://ubuntu.com/usn/usn-2570-1http://www.debian.org/security/2015/dsa-3238http://www.securitytracker.com/id/1032209https://chromium.googlesource.com/chromium/src/net/+/2359906c4fdfa9d44b045755d23fe5327c10e010https://code.google.com/p/chromium/issues/detail?id=455215https://security.gentoo.org/glsa/201506-04http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.htmlhttp://lists.opensuse.org/opensuse-updates/2015-04/msg00040.htmlhttp://lists.opensuse.org/opensuse-updates/2015-11/msg00024.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0816.htmlhttp://ubuntu.com/usn/usn-2570-1http://www.debian.org/security/2015/dsa-3238http://www.securitytracker.com/id/1032209https://chromium.googlesource.com/chromium/src/net/+/2359906c4fdfa9d44b045755d23fe5327c10e010https://code.google.com/p/chromium/issues/detail?id=455215https://security.gentoo.org/glsa/201506-04
2015-04-19
Published