Vulnerability Description
The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted JavaScript code.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian | Debian Linux | 8.0 |
| Chrome | <= 50.0.2661.87 | |
| Opensuse | Opensuse | 13.1 |
| V8 | <= 5.0.71 | |
| Nodejs | Node.Js | >= 0.10.0, < 0.10.46 |
| Canonical | Ubuntu Linux | 14.04 |
Related Weaknesses (CWE)
References
- http://googlechromereleases.blogspot.com/2016/05/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00043.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00048.html
- http://lists.opensuse.org/opensuse-updates/2016-07/msg00063.html
- http://rhn.redhat.com/errata/RHSA-2016-1080.html
- http://rhn.redhat.com/errata/RHSA-2017-0002.html
- http://www.debian.org/security/2016/dsa-3590
- http://www.securityfocus.com/bid/90584
- http://www.securitytracker.com/id/1035872
- http://www.ubuntu.com/usn/USN-2960-1
- https://access.redhat.com/errata/RHSA-2017:0879
- https://access.redhat.com/errata/RHSA-2017:0880
- https://access.redhat.com/errata/RHSA-2017:0881
- https://access.redhat.com/errata/RHSA-2017:0882
FAQ
What is CVE-2016-1669?
CVE-2016-1669 is a vulnerability with a CVSS score of 8.8 (HIGH). The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remo...
How severe is CVE-2016-1669?
CVE-2016-1669 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-1669?
Check the references section above for vendor advisories and patch information. Affected products include: Debian Debian Linux, Google Chrome, Opensuse Opensuse, Google V8, Nodejs Node.Js.