CVE-2015-1274

CWE-2546 documents6 sources
Severity
6.8MEDIUM
EPSS
2.3%
top 15.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Google ChromeDebian Debian LinuxOpensuse Opensuse+3 more
Timeline
PublishedJul 23
Latest updateMay 14

Description

Google Chrome before 44.0.2403.89 does not ensure that the auto-open list omits all dangerous file types, which makes it easier for remote attackers to execute arbitrary code by providing a crafted file and leveraging a user's previous "Always open files of this type" choice, related to download_commands.cc and download_prefs.cc.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages5 packages

▶NVDgoogle/chrome43.0.2357.134
▶NVDopensuse/opensuse13.1, 13.2+1
▶Ubuntuchromium-browser< 44.0.2403.89-0ubuntu0.14.04.1.1095

Also affects: Debian Linux 8.0, Enterprise Linux 6.0, 6.7.z

🔴Vulnerability Details

3
GHSA
GHSA-9pjq-5cvf-hrv7: Google Chrome before 44↗2022-05-14
▶
CVEList
CVE-2015-1274: Google Chrome before 44↗2015-07-23
▶
OSV
CVE-2015-1274: Google Chrome before 44↗2015-07-23
▶

📋Vendor Advisories

1
Red Hat
chromium-browser: Settings allowed executable files to run immediately after download in unsepcified↗2015-07-21
▶

💬Community

1
Bugzilla
CVE-2015-1274 chromium-browser: Settings allowed executable files to run immediately after download in unsepcified↗2015-07-22
▶
CVE-2015-1274 (MEDIUM CVSS 6.8) | Google Chrome before 44.0.2403.89 d | cvebase.io