CVE-2014-3160
Summary
| CVE | CVE-2014-3160 |
|---|---|
| State | PUBLISHED |
| Assigner | Chrome |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-07-20 11:12:50 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a crafted file. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 7.0 | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Application | Chrome | 36.0.1985.1 | All | All | All | |
| Application | Chrome | 36.0.1985.100 | All | All | All | |
| Application | Chrome | 36.0.1985.101 | All | All | All | |
| Application | Chrome | 36.0.1985.102 | All | All | All | |
| Application | Chrome | 36.0.1985.103 | All | All | All | |
| Application | Chrome | 36.0.1985.104 | All | All | All | |
| Application | Chrome | 36.0.1985.105 | All | All | All | |
| Application | Chrome | 36.0.1985.106 | All | All | All | |
| Application | Chrome | 36.0.1985.12 | All | All | All | |
| Application | Chrome | 36.0.1985.122 | All | All | All | |
| Application | Chrome | 36.0.1985.123 | All | All | All | |
| Application | Chrome | 36.0.1985.124 | All | All | All | |
| Application | Chrome | 36.0.1985.13 | All | All | All | |
| Application | Chrome | 36.0.1985.14 | All | All | All | |
| Application | Chrome | 36.0.1985.15 | All | All | All | |
| Application | Chrome | 36.0.1985.16 | All | All | All | |
| Application | Chrome | 36.0.1985.17 | All | All | All | |
| Application | Chrome | 36.0.1985.18 | All | All | All | |
| Application | Chrome | 36.0.1985.19 | All | All | All | |
| Application | Chrome | 36.0.1985.2 | All | All | All | |
| Application | Chrome | 36.0.1985.20 | All | All | All | |
| Application | Chrome | 36.0.1985.21 | All | All | All | |
| Application | Chrome | 36.0.1985.22 | All | All | All | |
| Application | Chrome | 36.0.1985.23 | All | All | All | |
| Application | Chrome | 36.0.1985.24 | All | All | All | |
| Application | Chrome | 36.0.1985.25 | All | All | All | |
| Application | Chrome | 36.0.1985.26 | All | All | All | |
| Application | Chrome | 36.0.1985.27 | All | All | All | |
| Application | Chrome | 36.0.1985.28 | All | All | All | |
| Application | Chrome | 36.0.1985.29 | All | All | All | |
| Application | Chrome | 36.0.1985.3 | All | All | All | |
| Application | Chrome | 36.0.1985.30 | All | All | All | |
| Application | Chrome | 36.0.1985.31 | All | All | All | |
| Application | Chrome | 36.0.1985.32 | All | All | All | |
| Application | Chrome | 36.0.1985.33 | All | All | All | |
| Application | Chrome | 36.0.1985.34 | All | All | All | |
| Application | Chrome | 36.0.1985.35 | All | All | All | |
| Application | Chrome | 36.0.1985.36 | All | All | All | |
| Application | Chrome | 36.0.1985.37 | All | All | All | |
| Application | Chrome | 36.0.1985.38 | All | All | All | |
| Application | Chrome | 36.0.1985.39 | All | All | All | |
| Application | Chrome | 36.0.1985.4 | All | All | All | |
| Application | Chrome | 36.0.1985.40 | All | All | All | |
| Application | Chrome | 36.0.1985.41 | All | All | All | |
| Application | Chrome | 36.0.1985.42 | All | All | All | |
| Application | Chrome | 36.0.1985.43 | All | All | All | |
| Application | Chrome | 36.0.1985.44 | All | All | All | |
| Application | Chrome | 36.0.1985.45 | All | All | All | |
| Application | Chrome | 36.0.1985.46 | All | All | All | |
| Application | Chrome | 36.0.1985.47 | All | All | All | |
| Application | Chrome | 36.0.1985.48 | All | All | All | |
| Application | Chrome | 36.0.1985.49 | All | All | All | |
| Application | Chrome | 36.0.1985.5 | All | All | All | |
| Application | Chrome | 36.0.1985.50 | All | All | All | |
| Application | Chrome | 36.0.1985.51 | All | All | All | |
| Application | Chrome | 36.0.1985.52 | All | All | All | |
| Application | Chrome | 36.0.1985.53 | All | All | All | |
| Application | Chrome | 36.0.1985.54 | All | All | All | |
| Application | Chrome | 36.0.1985.55 | All | All | All | |
| Application | Chrome | 36.0.1985.56 | All | All | All | |
| Application | Chrome | 36.0.1985.57 | All | All | All | |
| Application | Chrome | 36.0.1985.58 | All | All | All | |
| Application | Chrome | 36.0.1985.59 | All | All | All | |
| Application | Chrome | 36.0.1985.6 | All | All | All | |
| Application | Chrome | 36.0.1985.60 | All | All | All | |
| Application | Chrome | 36.0.1985.61 | All | All | All | |
| Application | Chrome | 36.0.1985.62 | All | All | All | |
| Application | Chrome | 36.0.1985.63 | All | All | All | |
| Application | Chrome | 36.0.1985.64 | All | All | All | |
| Application | Chrome | 36.0.1985.65 | All | All | All | |
| Application | Chrome | 36.0.1985.66 | All | All | All | |
| Application | Chrome | 36.0.1985.67 | All | All | All | |
| Application | Chrome | 36.0.1985.68 | All | All | All | |
| Application | Chrome | 36.0.1985.69 | All | All | All | |
| Application | Chrome | 36.0.1985.70 | All | All | All | |
| Application | Chrome | 36.0.1985.72 | All | All | All | |
| Application | Chrome | 36.0.1985.73 | All | All | All | |
| Application | Chrome | 36.0.1985.74 | All | All | All | |
| Application | Chrome | 36.0.1985.75 | All | All | All | |
| Application | Chrome | 36.0.1985.76 | All | All | All | |
| Application | Chrome | 36.0.1985.77 | All | All | All | |
| Application | Chrome | 36.0.1985.78 | All | All | All | |
| Application | Chrome | 36.0.1985.79 | All | All | All | |
| Application | Chrome | 36.0.1985.8 | All | All | All | |
| Application | Chrome | 36.0.1985.81 | All | All | All | |
| Application | Chrome | 36.0.1985.82 | All | All | All | |
| Application | Chrome | 36.0.1985.83 | All | All | All | |
| Application | Chrome | 36.0.1985.84 | All | All | All | |
| Application | Chrome | 36.0.1985.85 | All | All | All | |
| Application | Chrome | 36.0.1985.86 | All | All | All | |
| Application | Chrome | 36.0.1985.87 | All | All | All | |
| Application | Chrome | 36.0.1985.88 | All | All | All | |
| Application | Chrome | 36.0.1985.89 | All | All | All | |
| Application | Chrome | 36.0.1985.90 | All | All | All | |
| Application | Chrome | 36.0.1985.91 | All | All | All | |
| Application | Chrome | 36.0.1985.92 | All | All | All | |
| Application | Chrome | 36.0.1985.93 | All | All | All | |
| Application | Chrome | 36.0.1985.94 | All | All | All | |
| Application | Chrome | 36.0.1985.95 | All | All | All | |
| Application | Chrome | 36.0.1985.96 | All | All | All | |
| Application | Chrome | 36.0.1985.97 | All | All | All | |
| Application | Chrome | 36.0.1985.98 | All | All | All | |
| Application | Chrome | 36.0.1985.99 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Advisory SA60061 - SUSE update for chromium - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Google Chrome Prior to 36.0.1985.122 Multiple Security Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Issue 380885 - chromium - Security: Cache-based SOP-Bypass for Images - An open-source project to help move the web forward. - Google Project Hosting | af854a3a-2127-422b-91ae-364da2661108 | code.google.com | |
| Gentoo Linux Documentation -- Chromium: Multiple vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| Debian -- Security Information -- DSA-3039-1 chromium-browser | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| [blink] Revision 176084 | af854a3a-2127-422b-91ae-364da2661108 | src.chromium.org | |
| Security Advisory SA60372 - Ubuntu update for oxide-qt - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Chrome Releases: Stable Channel Update | af854a3a-2127-422b-91ae-364da2661108 | googlechromereleases.blogspot.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.