Vulnerability Description
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian | Debian Linux | 8.0 |
| Canonical | Ubuntu Linux | 14.04 |
| Chrome | < 49.0.2623.108 | |
| Suse | Package Hub | - |
| Opensuse | Leap | 42.1 |
| Opensuse | Opensuse | 13.1 |
| Redhat | Enterprise Linux Desktop | 6.0 |
| Redhat | Enterprise Linux Eus | 6.7 |
| Redhat | Enterprise Linux Server | 6.0 |
| Redhat | Enterprise Linux Workstation | 6.0 |
Related Weaknesses (CWE)
References
- http://googlechromereleases.blogspot.com/2016/03/stable-channel-update_24.htmlRelease NotesVendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00000.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00001.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00039.htmlMailing ListThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0525.htmlThird Party Advisory
- http://www.debian.org/security/2016/dsa-3531Mailing ListThird Party Advisory
- http://www.securitytracker.com/id/1035423Broken LinkThird Party AdvisoryVDB Entry
- http://www.ubuntu.com/usn/USN-2955-1Third Party Advisory
- https://code.google.com/p/chromium/issues/detail?id=594574ExploitIssue TrackingMailing List
- https://codereview.chromium.org/1804963002/Patch
- https://security.gentoo.org/glsa/201605-02Third Party Advisory
- http://googlechromereleases.blogspot.com/2016/03/stable-channel-update_24.htmlRelease NotesVendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00000.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00001.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00039.htmlMailing ListThird Party Advisory
FAQ
What is CVE-2016-1646?
CVE-2016-1646 is a vulnerability with a CVSS score of 8.8 (HIGH). The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to ca...
How severe is CVE-2016-1646?
CVE-2016-1646 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-1646?
Check the references section above for vendor advisories and patch information. Affected products include: Debian Debian Linux, Canonical Ubuntu Linux, Google Chrome, Suse Package Hub, Opensuse Leap.