{"api_version":"1","generated_at":"2026-07-23T11:10:05+00:00","cve":"CVE-2015-1257","urls":{"html":"https://cve.report/CVE-2015-1257","api":"https://cve.report/api/cve/CVE-2015-1257.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-1257","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-1257"},"summary":{"title":"CVE-2015-1257","description":"platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (container overflow) or possibly have unspecified other impact via a crafted document.","state":"PUBLISHED","assigner":"Chrome","published_at":"2015-05-20 10:59:09","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-119","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://src.chromium.org/viewvc/blink?view=rev&revision=193911","name":"https://src.chromium.org/viewvc/blink?view=rev&revision=193911","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[blink] Revision 193911","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1032375","name":"http://www.securitytracker.com/id/1032375","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Google Chrome Multiple Bugs Let Remote Users Execute Arbitrary Code, Bypass Same-Origin Restrictions, and Spoof URLs - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2015/dsa-3267","name":"http://www.debian.org/security/2015/dsa-3267","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Debian -- Security Information -- DSA-3267-1 chromium-browser","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html","name":"http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"openSUSE-SU-2015:1877-1: moderate: Security update for Chromium","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://src.chromium.org/viewvc/blink?view=rev&revision=193571","name":"https://src.chromium.org/viewvc/blink?view=rev&revision=193571","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[blink] Revision 193571","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://security.gentoo.org/glsa/201506-04","name":"https://security.gentoo.org/glsa/201506-04","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Chromium: Multiple vulnerabilities (GLSA 201506-04) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://code.google.com/p/chromium/issues/detail?id=468519","name":"https://code.google.com/p/chromium/issues/detail?id=468519","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Issue 468519 - \n chromium -\n \n Container-overflow in blink::FEColorMatrix::createImageFilter - \n An open-source project to help move the web forward. - Google Project Hosting","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html","name":"http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Object not found!","mime":"text/xml","httpstatus":"404","archivestatus":"404"},{"url":"http://www.securityfocus.com/bid/74723","name":"http://www.securityfocus.com/bid/74723","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Google Chrome Prior to 43.0.2357.65 Multiple Security Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html","name":"http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Chrome Releases: Stable Channel Update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1257","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1257","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"1257","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"1257","vulnerable":"1","versionEndIncluding":"42.0.2311.152","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"google","cpe5":"chrome","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T04:40:17.086Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://src.chromium.org/viewvc/blink?view=rev&revision=193911"},{"name":"openSUSE-SU-2015:0969","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://src.chromium.org/viewvc/blink?view=rev&revision=193571"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://code.google.com/p/chromium/issues/detail?id=468519"},{"name":"GLSA-201506-04","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"],"url":"https://security.gentoo.org/glsa/201506-04"},{"name":"openSUSE-SU-2015:1877","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html"},{"name":"1032375","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1032375"},{"name":"DSA-3267","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2015/dsa-3267"},{"name":"74723","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/74723"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-05-19T00:00:00.000Z","descriptions":[{"lang":"en","value":"platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (container overflow) or possibly have unspecified other impact via a crafted document."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-12-30T15:57:01.000Z","orgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","shortName":"Chrome"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://src.chromium.org/viewvc/blink?view=rev&revision=193911"},{"name":"openSUSE-SU-2015:0969","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html"},{"tags":["x_refsource_CONFIRM"],"url":"http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://src.chromium.org/viewvc/blink?view=rev&revision=193571"},{"tags":["x_refsource_CONFIRM"],"url":"https://code.google.com/p/chromium/issues/detail?id=468519"},{"name":"GLSA-201506-04","tags":["vendor-advisory","x_refsource_GENTOO"],"url":"https://security.gentoo.org/glsa/201506-04"},{"name":"openSUSE-SU-2015:1877","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html"},{"name":"1032375","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1032375"},{"name":"DSA-3267","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2015/dsa-3267"},{"name":"74723","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/74723"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@google.com","ID":"CVE-2015-1257","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (container overflow) or possibly have unspecified other impact via a crafted document."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://src.chromium.org/viewvc/blink?view=rev&revision=193911","refsource":"CONFIRM","url":"https://src.chromium.org/viewvc/blink?view=rev&revision=193911"},{"name":"openSUSE-SU-2015:0969","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html"},{"name":"http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html","refsource":"CONFIRM","url":"http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html"},{"name":"https://src.chromium.org/viewvc/blink?view=rev&revision=193571","refsource":"CONFIRM","url":"https://src.chromium.org/viewvc/blink?view=rev&revision=193571"},{"name":"https://code.google.com/p/chromium/issues/detail?id=468519","refsource":"CONFIRM","url":"https://code.google.com/p/chromium/issues/detail?id=468519"},{"name":"GLSA-201506-04","refsource":"GENTOO","url":"https://security.gentoo.org/glsa/201506-04"},{"name":"openSUSE-SU-2015:1877","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html"},{"name":"1032375","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1032375"},{"name":"DSA-3267","refsource":"DEBIAN","url":"http://www.debian.org/security/2015/dsa-3267"},{"name":"74723","refsource":"BID","url":"http://www.securityfocus.com/bid/74723"}]}}}},"cveMetadata":{"assignerOrgId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","assignerShortName":"Chrome","cveId":"CVE-2015-1257","datePublished":"2015-05-20T10:00:00.000Z","dateReserved":"2015-01-21T00:00:00.000Z","dateUpdated":"2024-08-06T04:40:17.086Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-05-20 10:59:09","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-119","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndIncluding":"42.0.2311.152","matchCriteriaId":"6F238C75-E24A-406F-BEB5-8758C8FE9603"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"1257","Ordinal":"1","Title":"CVE-2015-1257","CVE":"CVE-2015-1257","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"1257","Ordinal":"1","NoteData":"platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (container overflow) or possibly have unspecified other impact via a crafted document.","Type":"Description","Title":"CVE-2015-1257"},{"CveYear":"2015","CveId":"1257","Ordinal":"2","NoteData":"2015-05-20","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"1257","Ordinal":"3","NoteData":"2016-12-30","Type":"Other","Title":"Modified"}]}}}