PT-2016-6313 · Google+4 · Google Chrome+4

Adam Mariš · Published 2016-11-09 · Updated 2024-06-15 · CVE-2016-5202

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 54.0.2840.98 on macOS Google Chrome versions prior to 54.0.2840.99 on Windows Google Chrome versions prior to 54.0.2840.100 on Linux Opera (affected versions not specified)

Description The issue arises from a neglect to copy a device ID before an erase() call in the dial registry.cc file, leading to the erase operation accessing data that it will destroy. This affects the system, allowing attackers to exploit the weakness.

Recommendations For Google Chrome versions prior to 54.0.2840.98 on macOS, update to version 54.0.2840.98 or later. For Google Chrome versions prior to 54.0.2840.99 on Windows, update to version 54.0.2840.99 or later. For Google Chrome versions prior to 54.0.2840.100 on Linux, update to version 54.0.2840.100 or later. For Opera, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2016-5202

DSA-3731-1

MGASA-2016-0403

OPENSUSE-SU-2016_2793-1

OPENSUSE-SU-2024:10171-1

OPENSUSE-SU-2024:12948-1

RHSA-2016:2718

RHSA-2016_2718

USN-3133-1

Affected Products

Google Chrome

Opera

Red Hat

Suse

Ubuntu

References · 2358

• https://security-tracker.debian.org/tracker/CVE-2016-5202 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3133-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-5202 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3731-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3133-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-5198 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5202 · Security Note
• https://cve.org/CVERecord?id=CVE-2016-5202 · Security Note
• https://osv.dev/vulnerability/CVE-2016-5202 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-5202 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-5200 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0403.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10171-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0403 · Vendor Advisory