CVE-2015-1221
HighSummary
A use-after-free vulnerability in Blink, as used in Google Chrome before version 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect ordering of operations in the Web SQL Database thread relative to Blink's main thread.
Risk Assessment
Organizations may be exposed to attacks that lead to denial of service, potentially affecting the availability of web applications and the security of user data.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability and to monitor systems for potential attack attempts.
Other vulnerabilities in Blink (Google Chrome)
See all- CVE-2016-5170High
In Blink, used in Google Chrome before version 53.0.2785.113, there is an issue with improperly considering getter side effects during array key conversion. This can lead to denial of service (use-after-free) or other unspecified impacts via crafted Indexed Database API calls.
- CVE-2016-5150High
In Blink, used in Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux, there is an issue with the Indexed Database (IndexedDB) API implementation that does not properly restrict key-path evaluation. This can lead to denial of service (use-after-free) or other unspecified impacts via crafted JavaScript code.
- CVE-2016-1675High
Blink, as used in Google Chrome before version 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy by leveraging the mishandling of Document reattachment during destruction, related to FrameLoader.cpp and LocalFrame.cpp.
- CVE-2016-1661High
Blink in Google Chrome before version 50.0.2661.94 does not ensure that frames satisfy an additional check for the same renderer process, which can lead to denial of service (memory corruption) or other unspecified impacts via a crafted website.
- CVE-2015-1299High
A use-after-free vulnerability in the shared-timer implementation in Blink, as used in Google Chrome before version 45.0.2454.85, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging erroneous timer firing.
- CVE-2014-7907High
Multiple use-after-free vulnerabilities in ScreenOrientationController.cpp in Blink, used in Google Chrome before version 39.0.2171.65, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger improper handling of a detached frame, related to the (1) lock and (2) unlock methods.
- CVE-2014-3191High
A use-after-free vulnerability in Blink, used in Google Chrome before version 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers a widget-position update improperly interacting with the render tree.
- CVE-2014-3178High
A use-after-free vulnerability in Blink, as used in Google Chrome before version 37.0.2062.120, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of render-tree inconsistencies.
- CVE-2016-1633Critical
Use-after-free vulnerability in Blink, as used in Google Chrome before version 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Original NVD description (English source)
Use-after-free vulnerability in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect ordering of operations in the Web SQL Database thread relative to Blink's main thread, related to the shutdown function in web/WebKit.cpp.