FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2014-3166

This CVE name corresponds to:

Entered Topic
2014-08-13 chromium -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2014-3166 at cve.mitre.org

Details

Type Candidate
Name CVE-2014-3166
Phase Assigned(20140503)

Description

The Public Key Pinning (PKP) implementation in Google Chrome before 36.0.1985.143 on Windows, OS X, and Linux, and before 36.0.1985.135 on Android, does not correctly consider the properties of SPDY connections, which allows remote attackers to obtain sensitive information by leveraging the use of multiple domain names.

References

Source Reference
MLIST [tls] 20140810 Re: Inter-protocol attacks
CONFIRM http://googlechromereleases.blogspot.com/2014/08/chrome-for-android-update.html
CONFIRM http://googlechromereleases.blogspot.com/2014/08/stable-channel-update.html
CONFIRM https://code.google.com/p/chromium/issues/detail?id=398925
CONFIRM https://src.chromium.org/viewvc/chrome?revision=286598&view=revision
CONFIRM https://src.chromium.org/viewvc/chrome?revision=288435&view=revision
DEBIAN DSA-3039
SECTRACK 1030732

Copyright © 2005 The MITRE Corporation.

Copyright © 2003-2005 Jacques Vidrine and contributors.
Please see the source of this document for full copyright information.