Vulnerability Details : CVE-2014-7939
Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header.
Products affected by CVE-2014-7939
- cpe:2.3:o:redhat:enterprise_linux_desktop_supplementary:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_supplementary:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation_supplementary:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_supplementary_eus:6.6.z:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
- cpe:2.3:a:chromium:chromium:40.0.2214.110:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-7939
0.76%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 71 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-7939
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2014-7939
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-7939
-
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00005.html
[security-announce] openSUSE-SU-2015:0441-1: important: Security update
-
http://secunia.com/advisories/62665
Sign in
-
http://www.securitytracker.com/id/1031623
Google Chrome Multiple Bugs Let Remote Users Execute Arbitrary Code and Deny Service - SecurityTracker
-
http://www.securityfocus.com/bid/72288
Google Chrome 40.0.2214.91 Multiple Security Vulnerabilities
-
http://rhn.redhat.com/errata/RHSA-2015-0093.html
RHSA-2015:0093 - Security Advisory - Red Hat Customer Portal
-
https://code.google.com/p/chromium/issues/detail?id=399951
399951 - Security: Cross-origin information leak via ECMAScript harmony proxies - chromium - Monorail
-
http://googlechromereleases.blogspot.com/2015/01/stable-update.html
Chrome Releases: Stable Channel Update
-
http://secunia.com/advisories/62383
Sign in
-
http://security.gentoo.org/glsa/glsa-201502-13.xml
Chromium: Multiple vulnerabilities (GLSA 201502-13) — Gentoo security
Jump to