PT-2016-6258 · Google+1 · Google Chrome+1

Phil Oester · Publicado 2016-08-01 · Atualizado 2017-07-01 · CVE-2016-5138

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 52.0.2743.85

Description The issue is related to an integer overflow in the kbasep vinstr attach client function, which can be exploited by remote attackers to cause a denial of service. This is achieved through a heap-based buffer overflow and use-after-free by leveraging an unrestricted multiplication.

Recommendations For versions prior to 52.0.2743.85, update to version 52.0.2743.85 or later to resolve the issue.

Correção

DoS

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

ALT-PU-2016-2194

CVE-2016-5138

Produtos afetados

Alt Linux

Google Chrome

Referências · 8

• https://bugs.chromium.org/p/chromium/issues/detail?id=631752&desc=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-5138 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-5138 · Aviso do Fabricante
• http://securitytracker.com/id/1036484 · Nota
• https://security.gentoo.org/glsa/201610-09 · Aviso do Fabricante
• http://googlechromereleases.blogspot.com/2016/07/stable-channel-update-for-chrome-os_26.html · Nota
• http://securityfocus.com/bid/92139 · Nota
• https://chromium.googlesource.com/chromiumos/third_party/kernel/+/d65f7c158dabbb5b9e89723aceb30e874c2d748a · Nota