Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Chrome and related Linux packages may crash or be compromised

CVE-2015-1280 · published 11 years ago
Summary

Versions of Google Chrome older than 44 and certain Red Hat supplemental packages that include the Skia graphics library can be sent specially crafted data that corrupts memory, potentially causing the program to stop working or allowing further exploitation. This happens when an attacker can influence the browser's rendering process. Updating Chrome to a newer version and applying the latest Red Hat updates will fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
google chrome <= 43.0.2357.134
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
redhat enterprise_linux_desktop_supplementary 6.0
cpe:2.3:o:redhat:enterprise_linux_desktop_supplementary:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_server_supplementary 6.0
cpe:2.3:o:redhat:enterprise_linux_server_supplementary:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_server_supplementary_eus 6.7z
cpe:2.3:o:redhat:enterprise_linux_server_supplementary_eus:6.7z:*:*:*:*:*:*:*
redhat enterprise_linux_workstation_supplementary 6.0
cpe:2.3:o:redhat:enterprise_linux_workstation_supplementary:6.0:*:*:*:*:*:*:*
debian debian_linux 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
opensuse opensuse 13.1
13.2
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
Original advisory text
SkPictureShader.cpp in Skia, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leve...
SkPictureShader.cpp in Skia, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging access to a renderer process and providing crafted serialized data.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published23 Jul 2015
Updated28 Oct 2026
First seen29 Sep 2026
Sources
CVE-2015-1280 · NVD
Track software like this
Free during beta