PT-2016-2147 · Google+5 · Google Chrome+5
Atte Kettunen
·
Publicado
2016-05-25
·
Atualizado
2024-06-15
·
CVE-2016-1691
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 51.0.2704.63
Description
The issue is related to the mishandling of coincidence runs in the Skia component, which can be exploited by remote attackers to cause a denial of service or possibly have other unspecified impacts. This is achieved through crafted curves and is related to the SkOpCoincidence.cpp and SkPathOpsCommon.cpp files. The vulnerability allows attackers to perform heap-based buffer overflow attacks.
Recommendations
For Google Chrome versions prior to 51.0.2704.63, update to version 51.0.2704.63 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Skia component until a patch is available. Avoid using crafted curves that may trigger the coincidence runs mishandling in the Skia component.
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Google Chrome
Opera
Red Hat
Suse
Ubuntu