QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2015-1296

Back to search

CVE-2015-1296

Published: Sep 3, 2015

Modified: Aug 6, 2024

PUBLISHED

Description

The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages.

VendorProductVersions

n/a

n/a

affected
n/a

References

openSUSE-SU-2015:1873
vendor-advisory
x_refsource_SUSE
RHSA-2015:1712
vendor-advisory
x_refsource_REDHAT
1033472
vdb-entry
x_refsource_SECTRACK
openSUSE-SU-2015:1586
vendor-advisory
x_refsource_SUSE
DSA-3351
vendor-advisory
x_refsource_DEBIAN
GLSA-201603-09
vendor-advisory
x_refsource_GENTOO

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now