CVE-2016-1617
published 2016-01-25CVE-2016-1617: The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in…
PriorityP417medium4.3CVSS 3.0
AVNACLPRNUIRSUCLINAN
EPSS
1.27%
67.0th percentile
The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 48.0.2564.82, does not apply http policies to https URLs and does not apply ws policies to wss URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | <= 47.0.2526.106 | — | |
| chrome | <= 51.0.2704.106 | — |
CVSS provenance
nvdv3.04.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv7.6HIGH
vendor_ubuntu7.6HIGH
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
chromium-browser: history sniffing with hsts and csp
vendor_redhat·2016-07-20·CVSS 4.3
CVE-2016-5137 [MEDIUM] chromium-browser: history sniffing with hsts and csp
chromium-browser: history sniffing with hsts and csp
The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 52.0.2743.82, does not apply http :80 policies to https :443 URLs and does not apply ws :80 policies to wss :443 URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report. NOTE: this vulnerability is associated with a specification change after CVE-2016-1617 resolution.
Ubuntu
Oxide vulnerabilities
vendor_ubuntu·2016-01-27·CVSS 7.6
CVE-2016-1612 [HIGH] Oxide vulnerabilities
Title: Oxide vulnerabilities
Summary: Several security issues were fixed in Oxide.
A bad cast was discovered in V8. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this to
cause a denial of service via renderer crash or execute arbitrary code
with the privileges of the sandboxed render process. (CVE-2016-1612)
An issue was discovered when initializing the UnacceleratedImageBufferSurface
class in Blink. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to obtain sensitive
information. (CVE-2016-1614)
An issue was discovered with the CSP implementation in Blink. If a user
were tricked in to opening a specially crafted website, an attacker could
potentially exploit this to de
Red Hat
chromium-browser: various fixes from internal audits
vendor_redhat·2016-01-20·CVSS 4.3
CVE-2016-1617 [MEDIUM] chromium-browser: various fixes from internal audits
chromium-browser: various fixes from internal audits
The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 48.0.2564.82, does not apply http policies to https URLs and does not apply ws policies to wss URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report.
GHSA
GHSA-jc87-h9fr-rr78: The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource
ghsa_unreviewed·2022-05-17·CVSS 4.3
CVE-2016-5137 [MEDIUM] CWE-200 GHSA-jc87-h9fr-rr78: The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource
The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 52.0.2743.82, does not apply http :80 policies to https :443 URLs and does not apply ws :80 policies to wss :443 URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report. NOTE: this vulnerability is associated with a specification change after CVE-2016-1617 resolution.
GHSA
GHSA-wgvw-9qxr-cvw2: The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource
ghsa_unreviewed·2022-05-17
CVE-2016-1617 [MEDIUM] CWE-200 GHSA-wgvw-9qxr-cvw2: The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource
The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 48.0.2564.82, does not apply http policies to https URLs and does not apply ws policies to wss URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report.
OSV
CVE-2016-5137: The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource
osv·2016-07-23·CVSS 4.3
CVE-2016-5137 [MEDIUM] CVE-2016-5137: The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource
The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 52.0.2743.82, does not apply http :80 policies to https :443 URLs and does not apply ws :80 policies to wss :443 URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report. NOTE: this vulnerability is associated with a specification change after CVE-2016-1617 resolution.
OSV
oxide-qt vulnerabilities
osv·2016-01-27·CVSS 7.6
CVE-2016-1612 [HIGH] oxide-qt vulnerabilities
oxide-qt vulnerabilities
A bad cast was discovered in V8. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this to
cause a denial of service via renderer crash or execute arbitrary code
with the privileges of the sandboxed render process. (CVE-2016-1612)
An issue was discovered when initializing the UnacceleratedImageBufferSurface
class in Blink. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to obtain sensitive
information. (CVE-2016-1614)
An issue was discovered with the CSP implementation in Blink. If a user
were tricked in to opening a specially crafted website, an attacker could
potentially exploit this to determine whether specific HSTS sites had been
visited by rea
OSV
CVE-2016-1617: The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource
osv·2016-01-22·CVSS 4.3
CVE-2016-1617 [MEDIUM] CVE-2016-1617: The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource
The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 48.0.2564.82, does not apply http policies to https URLs and does not apply ws policies to wss URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report.
No detection rules found.
No public exploits indexed.
http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00046.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0072.htmlhttp://www.debian.org/security/2016/dsa-3456http://www.securityfocus.com/bid/81430http://www.securitytracker.com/id/1034801http://www.ubuntu.com/usn/USN-2877-1https://code.google.com/p/chromium/issues/detail?id=544765https://codereview.chromium.org/1455973003https://security.gentoo.org/glsa/201603-09http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00046.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0072.htmlhttp://www.debian.org/security/2016/dsa-3456http://www.securityfocus.com/bid/81430http://www.securitytracker.com/id/1034801http://www.ubuntu.com/usn/USN-2877-1https://code.google.com/p/chromium/issues/detail?id=544765https://codereview.chromium.org/1455973003https://security.gentoo.org/glsa/201603-09
2016-01-25
Published