Description
The Inter-process Communication (IPC) implementation in Google Chrome before 18.0.1025.168, as used in Mozilla Firefox before 38.0 and other products, does not properly validate messages, which has unspecified impact and attack vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | iceweasel | 31.7.0esr-1~deb8u1 | DSA-3260-1 |
| Debian 7 | iceweasel | 31.7.0esr-1~deb7u1 | DSA-3260-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 | openSUSE-SU-2024:10071-1 |
| openSUSE Tumbleweed | MozillaThunderbird | 45.5.1-1.1 | openSUSE-SU-2024:10230-1 |
| openSUSE Tumbleweed | chromium | 55.0.2883.75-3.1 | openSUSE-SU-2024:12948-1, openSUSE-SU-2024:10171-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Advisories 6
- DSA-3260-1 iceweasel - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10171-1 chromedriver-55.0.2883.75-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10230-1 MozillaThunderbird-45.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12948-1 ungoogled-chromium-113.0.5672.92-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10071-1 MozillaFirefox-50.1.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
- http://googlechromereleases.blogspot.com/2012/04/stable-channel-update_30.html
- 48992 third-party-advisory
- 1027001 vdb-entry
- oval:org.mitre.oval:def:14964 vdb-entry signature
- openSUSE-SU-2015:0892 vendor-advisory
- http://www.mozilla.org/security/announce/2015/mfsa2015-57.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1087565
- 81645 vdb-entry
- DSA-3260 vendor-advisory
- http://code.google.com/p/chromium/issues/detail?id=117627
- openSUSE-SU-2015:0934 vendor-advisory
- RHSA-2015:1012 vendor-advisory
- openSUSE-SU-2015:1266 vendor-advisory
- 53309 vdb-entry
- chrome-ipc-validation-code-execution(75271) vdb-entry