Information disclosure in Debian Linux - CVE-2014-3166

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU41417

Information disclosure in Debian Linux - CVE-2014-3166

Published: August 13, 2014 / Updated: August 10, 2020


Vulnerability identifier: #VU41417
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-3166
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The Public Key Pinning (PKP) implementation in Google Chrome before 36.0.1985.143 on Windows, OS X, and Linux, and before 36.0.1985.135 on Android, does not correctly consider the properties of SPDY connections, which allows remote attackers to obtain sensitive information by leveraging the use of multiple domain names.


Affected software

Debian Linux
Ubuntu
liboxideqtcore0 (Ubuntu package)
oxideqt-codecs-extra (Ubuntu package)
oxideqt-codecs (Ubuntu package)

How to mitigate CVE-2014-3166

Install update from vendor's website.

liboxideqtcore0 (Ubuntu package) - update to 1.0.5-0ubuntu0.14.04.1
oxideqt-codecs-extra (Ubuntu package) - update to 1.0.5-0ubuntu0.14.04.1
oxideqt-codecs (Ubuntu package) - update to 1.0.5-0ubuntu0.14.04.1

External References

Related Security Bulletins