CVE-2016-7152
CVE-2016-7152
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.
CVSS 5.3 · Medium · EPSS 12.8%
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
oxide-qt Ubuntu:16.04:LTS
- Versions
- 1.9.5-0ubuntu1
- 1.10.3-0ubuntu0.15.10.1
- 1.10.3-0ubuntu0.15.10.2
- 1.11.3-0ubuntu3
- 1.11.4-0ubuntu1
- 1.11.5-0ubuntu1
- 1.12.5-0ubuntu1
- 1.12.6-0ubuntu1
- 1.12.7-0ubuntu1
- 1.13.6-0ubuntu1
- 1.14.7-0ubuntu1
- 1.14.9-0ubuntu0.16.04.1
- 1.15.7-0ubuntu0.16.04.1
- 1.15.8-0ubuntu0.16.04.1
- 1.16.5-0ubuntu0.16.04.1
- 1.17.7-0ubuntu0.16.04.1
- 1.17.9-0ubuntu0.16.04.1
- 1.18.3-0ubuntu0.16.04.1
- 1.18.5-0ubuntu0.16.04.1
- 1.19.4-0ubuntu0.16.04.1
- 1.20.4-0ubuntu0.16.04.1
- 1.21.5-0ubuntu0.16.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- http://www.securitytracker.com/id/1036741
- http://www.securitytracker.com/id/1036742
- http://www.securityfocus.com/bid/92769
- https://tom.vg/papers/heist_blackhat2016.pdf
- http://www.securitytracker.com/id/1036745
- http://arstechnica.com/security/2016/08/new-attack-steals-ssns-e-mail-addresses-and-more-from-https-pages/
- http://www.securitytracker.com/id/1036744
- http://www.securitytracker.com/id/1036743
- http://www.securitytracker.com/id/1036746
- https://nvd.nist.gov/vuln/detail/CVE-2016-7152