製品・ソフトウェアに関する情報

JVN脆弱性詳細

複数の製品で使用される Webkit におけるフラグメント識別子から重要な情報を取得される脆弱性

Title	複数の製品で使用される Webkit におけるフラグメント識別子から重要な情報を取得される脆弱性
Summary	Google Chrome には、フラグメント識別子から重要な情報を取得される脆弱性が存在します。本脆弱性は Webkit における脆弱性です。 Google Chrome 以外の Webkit を利用する製品も影響を受ける可能性があります。
Possible impacts	第三者により、異なるドメインに関連付けられた IFRAME 要素へのアクセスを利用されることで、フラグメント識別子から重要な情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 26, 2012, midnight
Registration Date	June 28, 2012, 2:21 p.m.
Last Update	Oct. 5, 2012, 5:16 p.m.

CVSS2.0 : 警告
Score	5
Vector	AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected System

アップル

iOS 6 未満 (iPad、iPad 2)

iOS 6 未満 (iPhone 3GS、iPhone 4、iPhone 4S)

iOS 6 未満 (iPod touch 第 3 世代以降)

Safari 6.0 未満 (Mac OS)

Google

Google Chrome 20.0.1132.43 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-2815	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2815
National Vulnerability Database (NVD)
2	CVE-2012-2815	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2815

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Apple Security Updates
1	HT5400	http://support.apple.com/kb/HT5400
2	HT5503	http://support.apple.com/kb/HT5503
Apple セキュリティアップデート
3	HT5400	http://support.apple.com/kb/HT5400?viewlocale=ja_JP
4	HT5503	http://support.apple.com/kb/HT5503?viewlocale=ja_JP
Google
5	Google Chrome	http://www.google.co.jp/chrome/intl/ja/landing_ff_yt.html?hl=ja&hl=ja
6	Stable Channel Update	http://googlechromereleases.blogspot.jp/2012/06/stable-channel-update_26.html
opensuse-updates
7	openSUSE-SU-2012:0813	http://lists.opensuse.org/opensuse-updates/2012-07/msg00003.html

その他

No	Name	URL
JVN
1	JVNVU#624491	http://jvn.jp/cert/JVNVU624491/
2	JVNVU#864819	http://jvn.jp/cert/JVNVU864819/

Change Log

No	Changed Details	Date of change
0	[2012年06月28日] 掲載 [2012年07月26日] ベンダ情報：openSUSE (openSUSE-SU-2012:0813) を追加 [2012年07月30日] タイトル：アップル (HT5400) の公開に伴い内容を更新概要：アップル (HT5400) の公開に伴い内容を更新影響を受けるシステム：アップル (HT5400) の情報を追加ベンダ情報：アップル (HT5400) を追加 [2012年10月05日] 影響を受けるシステム：アップル (HT5503) の情報を追加ベンダ情報：アップル (HT5503) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2012-2815

Summary	Google Chrome before 20.0.1132.43 allows remote attackers to obtain potentially sensitive information from a fragment identifier by leveraging access to an IFRAME element associated with a different domain.
Publication Date	June 27, 2012, 7:18 p.m.
Registration Date	Jan. 28, 2021, 2:59 p.m.
Last Update	Nov. 21, 2024, 10:39 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:google:chrome:20.0.1132.37:::::::*
cpe:2.3:a:google:chrome:20.0.1132.16:::::::*
cpe:2.3:a:google:chrome:20.0.1132.14:::::::*
cpe:2.3:a:google:chrome:20.0.1132.22:::::::*
cpe:2.3:a:google:chrome:20.0.1132.30:::::::*
cpe:2.3:a:google:chrome:20.0.1132.26:::::::*
cpe:2.3:a:google:chrome:20.0.1132.2:::::::*
cpe:2.3:a:google:chrome:20.0.1132.11:::::::*
cpe:2.3:a:google:chrome:20.0.1132.3:::::::*
cpe:2.3:a:google:chrome:20.0.1132.25:::::::*
cpe:2.3:a:google:chrome:20.0.1132.24:::::::*
cpe:2.3:a:google:chrome:20.0.1132.41:::::::*
cpe:2.3:a:google:chrome:20.0.1132.32:::::::*
cpe:2.3:a:google:chrome:20.0.1132.38:::::::*
cpe:2.3:a:google:chrome:20.0.1132.31:::::::*
cpe:2.3:a:google:chrome:20.0.1132.8:::::::*
cpe:2.3:a:google:chrome:20.0.1132.4:::::::*
cpe:2.3:a:google:chrome:20.0.1132.17:::::::*
cpe:2.3:a:google:chrome:20.0.1132.7:::::::*
cpe:2.3:a:google:chrome:20.0.1132.18:::::::*
cpe:2.3:a:google:chrome:20.0.1132.0:::::::*
cpe:2.3:a:google:chrome::::::::		20.0.1132.42
cpe:2.3:a:google:chrome:20.0.1132.5:::::::*
cpe:2.3:a:google:chrome:20.0.1132.27:::::::*
cpe:2.3:a:google:chrome:20.0.1132.1:::::::*
cpe:2.3:a:google:chrome:20.0.1132.35:::::::*
cpe:2.3:a:google:chrome:20.0.1132.15:::::::*
cpe:2.3:a:google:chrome:20.0.1132.20:::::::*
cpe:2.3:a:google:chrome:20.0.1132.21:::::::*
cpe:2.3:a:google:chrome:20.0.1132.33:::::::*
cpe:2.3:a:google:chrome:20.0.1132.10:::::::*
cpe:2.3:a:google:chrome:20.0.1132.9:::::::*
cpe:2.3:a:google:chrome:20.0.1132.23:::::::*
cpe:2.3:a:google:chrome:20.0.1132.28:::::::*
cpe:2.3:a:google:chrome:20.0.1132.19:::::::*
cpe:2.3:a:google:chrome:20.0.1132.36:::::::*
cpe:2.3:a:google:chrome:20.0.1132.12:::::::*
cpe:2.3:a:google:chrome:20.0.1132.13:::::::*
cpe:2.3:a:google:chrome:20.0.1132.29:::::::*
cpe:2.3:a:google:chrome:20.0.1132.6:::::::*
cpe:2.3:a:google:chrome:20.0.1132.39:::::::*
cpe:2.3:a:google:chrome:20.0.1132.34:::::::*
cpe:2.3:a:google:chrome:20.0.1132.40:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://code.google.com/p/chromium/issues/detail?id=118633
2	http://code.google.com/p/chromium/issues/detail?id=118633
3	http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html
4	http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html
5	http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
6	http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
7	http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html
8	http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html
9	http://support.apple.com/kb/HT5400
10	http://support.apple.com/kb/HT5400
11	http://support.apple.com/kb/HT5503
12	http://support.apple.com/kb/HT5503
13	https://hermes.opensuse.org/messages/15075728
14	https://hermes.opensuse.org/messages/15075728
15	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15662
16	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15662

Common Vulnerabilities List

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:google:chrome:20.0.1132.37:::::::*
cpe:2.3:a:google:chrome:20.0.1132.16:::::::*
cpe:2.3:a:google:chrome:20.0.1132.14:::::::*
cpe:2.3:a:google:chrome:20.0.1132.22:::::::*
cpe:2.3:a:google:chrome:20.0.1132.30:::::::*
cpe:2.3:a:google:chrome:20.0.1132.26:::::::*
cpe:2.3:a:google:chrome:20.0.1132.2:::::::*
cpe:2.3:a:google:chrome:20.0.1132.11:::::::*
cpe:2.3:a:google:chrome:20.0.1132.3:::::::*
cpe:2.3:a:google:chrome:20.0.1132.25:::::::*
cpe:2.3:a:google:chrome:20.0.1132.24:::::::*
cpe:2.3:a:google:chrome:20.0.1132.41:::::::*
cpe:2.3:a:google:chrome:20.0.1132.32:::::::*
cpe:2.3:a:google:chrome:20.0.1132.38:::::::*
cpe:2.3:a:google:chrome:20.0.1132.31:::::::*
cpe:2.3:a:google:chrome:20.0.1132.8:::::::*
cpe:2.3:a:google:chrome:20.0.1132.4:::::::*
cpe:2.3:a:google:chrome:20.0.1132.17:::::::*
cpe:2.3:a:google:chrome:20.0.1132.7:::::::*
cpe:2.3:a:google:chrome:20.0.1132.18:::::::*
cpe:2.3:a:google:chrome:20.0.1132.0:::::::*
cpe:2.3:a:google:chrome::::::::		20.0.1132.42
cpe:2.3:a:google:chrome:20.0.1132.5:::::::*
cpe:2.3:a:google:chrome:20.0.1132.27:::::::*
cpe:2.3:a:google:chrome:20.0.1132.1:::::::*
cpe:2.3:a:google:chrome:20.0.1132.35:::::::*
cpe:2.3:a:google:chrome:20.0.1132.15:::::::*
cpe:2.3:a:google:chrome:20.0.1132.20:::::::*
cpe:2.3:a:google:chrome:20.0.1132.21:::::::*
cpe:2.3:a:google:chrome:20.0.1132.33:::::::*
cpe:2.3:a:google:chrome:20.0.1132.10:::::::*
cpe:2.3:a:google:chrome:20.0.1132.9:::::::*
cpe:2.3:a:google:chrome:20.0.1132.23:::::::*
cpe:2.3:a:google:chrome:20.0.1132.28:::::::*
cpe:2.3:a:google:chrome:20.0.1132.19:::::::*
cpe:2.3:a:google:chrome:20.0.1132.36:::::::*
cpe:2.3:a:google:chrome:20.0.1132.12:::::::*
cpe:2.3:a:google:chrome:20.0.1132.13:::::::*
cpe:2.3:a:google:chrome:20.0.1132.29:::::::*
cpe:2.3:a:google:chrome:20.0.1132.6:::::::*
cpe:2.3:a:google:chrome:20.0.1132.39:::::::*
cpe:2.3:a:google:chrome:20.0.1132.34:::::::*
cpe:2.3:a:google:chrome:20.0.1132.40:::::::*