CVE-2015-1263 - Vulnerability Details - OpenCVE

The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00689.

Key SSVC decision points have not yet been added.

Vendors	Products
Debian	Debian Linux
Google	Chrome
Redhat	Rhel Extras

Configuration 1 [-]

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Supplementary for Red Hat Enterprise Linux 6
chromium-browser-0:43.0.2357.65-1.el6_6	cpe:/a:redhat:rhel_extras:6	RHSA-2015:1023	2015-05-25T00:00:00Z

No data.

References

Link	Providers
http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html
http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html
http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html
http://www.debian.org/security/2015/dsa-3267
http://www.securityfocus.com/bid/74723
http://www.securitytracker.com/id/1032375
https://code.google.com/p/chromium/issues/detail?id=479162
https://codereview.chromium.org/1056103005
https://nvd.nist.gov/vuln/detail/CVE-2015-1263
https://security.gentoo.org/glsa/201506-04
https://www.cve.org/CVERecord?id=CVE-2015-1263

History

No history.

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2015-05-20T10:00:00.000Z

Updated: 2024-08-06T04:40:18.150Z

Reserved: 2015-01-21T00:00:00.000Z

Link: CVE-2015-1263

Vulnrichment

No data.

NVD

Status : Modified

Published: 2015-05-20T10:59:15.307

Modified: 2026-05-06T22:30:45.220

Link: CVE-2015-1263

Redhat

Severity : Low

Publid Date: 2015-05-19T00:00:00Z

Links: CVE-2015-1263 - Bugzilla

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-05-19T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-12-30T15:57:01.000Z", "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome"}, "references": [{"name": "openSUSE-SU-2015:0969", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://codereview.chromium.org/1056103005"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://code.google.com/p/chromium/issues/detail?id=479162"}, {"name": "GLSA-201506-04", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201506-04"}, {"name": "openSUSE-SU-2015:1877", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html"}, {"name": "1032375", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1032375"}, {"name": "DSA-3267", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2015/dsa-3267"}, {"name": "74723", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/74723"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@google.com", "ID": "CVE-2015-1263", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "openSUSE-SU-2015:0969", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html"}, {"name": "http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html", "refsource": "CONFIRM", "url": "http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html"}, {"name": "https://codereview.chromium.org/1056103005", "refsource": "CONFIRM", "url": "https://codereview.chromium.org/1056103005"}, {"name": "https://code.google.com/p/chromium/issues/detail?id=479162", "refsource": "CONFIRM", "url": "https://code.google.com/p/chromium/issues/detail?id=479162"}, {"name": "GLSA-201506-04", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201506-04"}, {"name": "openSUSE-SU-2015:1877", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html"}, {"name": "1032375", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1032375"}, {"name": "DSA-3267", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2015/dsa-3267"}, {"name": "74723", "refsource": "BID", "url": "http://www.securityfocus.com/bid/74723"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T04:40:18.150Z"}, "title": "CVE Program Container", "references": [{"name": "openSUSE-SU-2015:0969", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://codereview.chromium.org/1056103005"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://code.google.com/p/chromium/issues/detail?id=479162"}, {"name": "GLSA-201506-04", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201506-04"}, {"name": "openSUSE-SU-2015:1877", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html"}, {"name": "1032375", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1032375"}, {"name": "DSA-3267", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2015/dsa-3267"}, {"name": "74723", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/74723"}]}]}, "cveMetadata": {"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "assignerShortName": "Chrome", "cveId": "CVE-2015-1263", "datePublished": "2015-05-20T10:00:00.000Z", "dateReserved": "2015-01-21T00:00:00.000Z", "dateUpdated": "2024-08-06T04:40:18.150Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "6F238C75-E24A-406F-BEB5-8758C8FE9603", "versionEndIncluding": "42.0.2311.152", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file."}, {"lang": "es", "value": "La implementaci\u00f3n Spellcheck API en Google Chrome anterior a 43.0.2357.65 no utiliza una sesi\u00f3n HTTPS para descargar un diccionario Hunspell, lo que permite a atacantes man-in-the-middle entregar sugerencias de ortograf\u00eda incorrectas o posiblemente tener otro impacto no especificado a trav\u00e9s de un fichero manipulado."}], "id": "CVE-2015-1263", "lastModified": "2026-05-06T22:30:45.220", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2015-05-20T10:59:15.307", "references": [{"source": "chrome-cve-admin@google.com", "url": "http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html"}, {"source": "chrome-cve-admin@google.com", "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html"}, {"source": "chrome-cve-admin@google.com", "url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html"}, {"source": "chrome-cve-admin@google.com", "url": "http://www.debian.org/security/2015/dsa-3267"}, {"source": "chrome-cve-admin@google.com", "url": "http://www.securityfocus.com/bid/74723"}, {"source": "chrome-cve-admin@google.com", "url": "http://www.securitytracker.com/id/1032375"}, {"source": "chrome-cve-admin@google.com", "url": "https://code.google.com/p/chromium/issues/detail?id=479162"}, {"source": "chrome-cve-admin@google.com", "url": "https://codereview.chromium.org/1056103005"}, {"source": "chrome-cve-admin@google.com", "url": "https://security.gentoo.org/glsa/201506-04"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00091.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00015.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2015/dsa-3267"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/74723"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1032375"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://code.google.com/p/chromium/issues/detail?id=479162"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://codereview.chromium.org/1056103005"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201506-04"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-17"}], "source": "nvd@nist.gov", "type": "Primary"}]}