CVE-2015-1288

MEDIUM · 6.8 CVSS Gepubliceerd: 23-07-2015 CWE-17

Beschrijving

The Spellcheck API implementation in Google Chrome before 44.0.2403.89 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file, a related issue to CVE-2015-1263.

Vendors

Google Debian Redhat Opensuse

Affected products

Chrome Debian Linux Enterprise Linux Desktop Supplementary Enterprise Linux Server Supplementary Enterprise Linux Server Supplementary Eus Enterprise Linux Workstation Supplementary Opensuse

References

googlechromereleases.blogspot.com
lists.opensuse.org
rhn.redhat.com
www.debian.org
www.securityfocus.com
www.securitytracker.com
code.google.com
codereview.chromium.org
security.gentoo.org