CVE-2015-1274 in Chrome
Summary
Google Chrome before 44.0.2403.89 does not ensure that the auto-open list omits all dangerous file types, which makes it easier for remote attackers to execute arbitrary code by providing a crafted file and leveraging a user's previous "Always open files of this type" choice, related to download_commands.cc and download_prefs.cc.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Reservation
01/21/2015
Disclosure
07/22/2015
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 76775 | Google Chrome Auto-Open download_commands.cc 7pk security | 254 | Not defined | Official fix | CVE-2015-1274 |