PT-2016-7310 · Google+2 · Skia+3

Publicado 2016-09-11 · Atualizado 2017-01-07 · CVE-2016-7395

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 53.0.2785.89 on Windows and OS X Google Chrome versions prior to 53.0.2785.92 on Linux

Description The issue is related to the SkPath.cpp in Skia, which does not properly validate the return values of ChopMonoAtY calls. This allows remote attackers to cause a denial of service, resulting in uninitialized memory access and application crash, or possibly have other unspecified impact via crafted graphics data.

Recommendations For Google Chrome versions prior to 53.0.2785.89 on Windows and OS X, update to version 53.0.2785.89 or later. For Google Chrome versions prior to 53.0.2785.92 on Linux, update to version 53.0.2785.92 or later.

Correção

DoS

Enumeração de Fraquezas

CWE-19

Identificadores relacionados

ALT-PU-2016-2194

CVE-2016-7395

DSA-3667-1

Produtos afetados

Alt Linux

Google Chrome

Opera

Skia

Referências · 11

• https://osv.dev/vulnerability/DSA-3667-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2016-7395 · Nota de Segurança
• https://crbug.com/613918 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-7395 · Nota de Segurança
• http://debian.org/security/2016/dsa-3667 · Aviso do Fabricante
• https://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop_31.html · Nota
• https://osv.dev/vulnerability/CVE-2016-7395 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-7395 · Aviso do Fabricante
• https://codereview.chromium.org/2006143009 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-7395 · Aviso do Fabricante
• http://securityfocus.com/bid/92717 · Nota