CVE-2013-0927: google chrome_os Link Following

Vulnerability summary

CVE-2013-0927 is a high (CVSS 7.5) Link Following vulnerability in google chrome_os. EPSS estimates a 0.83% chance of exploitation in the next 30 days, higher than 56.8% of scored vulnerabilities.

Timeline

1. 10-04-2013
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

Google Chrome OS before 26.0.1410.57 relies on a Pango pango-utils.c read_config implementation that loads the contents of the .pangorc file in the user's home directory, and the file referenced by the PANGO_RC_FILE environment variable, which allows attackers to bypass intended access restrictions via crafted configuration data.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.