CVE-2015-1274
Fixed in a distro release EPSS 4%
Google Chrome before 44.0.2403.89 does not ensure that the auto-open list omits all dangerous file types, which makes it easier for remote attackers to execute arbitrary code by providing a crafted file and leveraging a user's previous "Always open files of this type" choice, related to download_commands.cc and download_prefs.cc.
Products: debian_linux, opensuse, redhat enterprise_linux_desktop_supplementary, redhat enterprise_linux_server_supplementary, redhat enterprise_linux_workstation_supplementary, google chrome
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 8 | chromium-browser | 44.0.2403.89-1~deb8u1 |
| Red Hat rhel extras 6 | chromium-browser | 0:44.0.2403.89-1.el6 |
| Red Hat rhel extras 6 | chromium-browser-debuginfo | 0:44.0.2403.89-1.el6 |
| Ubuntu 14.04 LTS | chromium-browser | 44.0.2403.89-0ubuntu0.14.04.1.1095 |
| openSUSE Tumbleweed | chromium | 55.0.2883.75-3.1 |
| openSUSE Tumbleweed | chromium | 113.0.5672.92-1.1 |