Published: 11/09/2016 Updated: 07/11/2023

CVSS v2 Base Score: 2.6 | Impact Score: 2.9 | Exploitability Score: 4.9

CVSS v3 Base Score: 3.1 | Impact Score: 1.4 | Exploitability Score: 1.6

VMScore: 231

Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N

The download implementation in Google Chrome prior to 53.0.2785.89 on Windows and OS X and prior to 53.0.2785.92 on Linux does not properly restrict saving a file:// URL that is referenced by an URL, which makes it easier for user-assisted remote malicious users to discover NetNTLM hashes and conduct SMB relay attacks via a crafted web page that is accessed with the "Save page as" menu choice.

Vulnerable Product	Search on Vulmon	Subscribe to Product
google chrome
opensuse leap 42.1

Several vulnerabilities have been discovered in the chromium web browser CVE-2016-5147 A cross-site scripting issue was discovered CVE-2016-5148 Another cross-site scripting issue was discovered CVE-2016-5149 Max Justicz discovered a script injection issue in extension handling CVE-2016-5150 A use-after-free issue was discovere ...

The download implementation in Google Chrome before 530278589 on Windows and OS X and before 530278592 on Linux does not properly restrict saving a file:// URL that is referenced by an URL, which makes it easier for user-assisted remote attackers to discover NetNTLM hashes and conduct SMB relay attacks via a crafted web page that is a ...

The download implementation in Chromium does not properly restrict saving a file:// URL that is referenced by an URL, which makes it easier for user-assisted remote attackers to discover NetNTLM hashes and conduct SMB relay attacks via a crafted web page that is accessed with the "Save page as" menu choice ...

CWE-200 http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00003.html https://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop_31.html http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00004.html http://www.securityfocus.com/bid/92717 http://www.securitytracker.com/id/1036729 https://codereview.chromium.org/2075273002 http://lists.opensuse.org/opensuse-updates/2016-09/msg00073.html https://crbug.com/616429 http://www.debian.org/security/2016/dsa-3660 https://security.gentoo.org/glsa/201610-09 http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00008.html http://rhn.redhat.com/errata/RHSA-2016-1854.html https://nvd.nist.gov https://www.debian.org/security/./dsa-3660

CVE-2016-5166

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect