KLA10893
Multiple vulnerabilities in Yandex browser
Обновлено: 17/06/2019
Дата обнаружения
26/10/2016
Уровень угрозы
Warning
Описание

Multiple serious vulnerabilities have been found in Yandex Browser. Malicious users can exploit these vulnerabilities to inject arbitrary code or obtain sensitive information.

Below is a complete list of vulnerabilities

  1. Cross-site scripting vulnerabilities at Translator and BookReader can be exploited to inject arbitrary JavaScript code;
  2. CSRF vulnerability at synchronization form can be exploited to obtain sensitive information;
  3. An unknown vulnerability at Anti-phishing warning can be exploited remotely to brute-force passwords via injected JavaScript;
  4. An unknown vulnerability at Security WiFi can be exploited remotely to obtain sensitive information.

Technical details

Vulnerability (2) can be exploited to steal data saved in browser profile.

Vulnerability (4) can be exploited to sniff traffic from open or protected wi-fi networks.

Пораженные продукты

Yandex Browser versions earlier than 16.9 excluding version 16.7

Решение

Update to the latest version
Get Yandex Browser

Первичный источник обнаружения
Yandex Browser changelogs
Оказываемое влияние
?
OSI 
[?]

CI 
[?]
Связанные продукты
Yandex Browser
CVE-IDS
CVE-2016-85064.3Warning
CVE-2016-85054.3Warning
CVE-2016-85044.3Warning
CVE-2016-85035.0Critical
CVE-2016-85025.0Critical
CVE-2016-85015.0Critical