CVE-2016-5142
chromium-browser: Use-after-free in Blink
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (alta), Ubuntu (media).
Descripción
The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code, related to NormalizeAlgorithm.cpp and SubtleCrypto.cpp.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 7 | chromium-browser | sin corrección indicada |
| debian 8 | chromium-browser | 52.0.2743.116-1~deb8u1 |
| ubuntu 14.04 | chromium-browser, oxide-qt | 52.0.2743.116-0ubuntu0.14.04.1.1134 y 1 más |
| ubuntu 16.04 | chromium-browser, oxide-qt | 52.0.2743.116-0ubuntu0.16.04.1.1250 y 1 más |
| ubuntu 16.04-ESM | oxide-qt | 1.17.7-0ubuntu0.16.04.1 |
| ubuntu 16.10 | chromium-browser, oxide-qt | 53.0.2785.143-0ubuntu1.1307 y 1 más |
Mostrar las 9 entradas de 6 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 7 | chromium-browser | sin corrección indicada |
| debian 8 | chromium-browser | 52.0.2743.116-1~deb8u1 |
| ubuntu 14.04 | chromium-browser | 52.0.2743.116-0ubuntu0.14.04.1.1134 |
| ubuntu 14.04 | oxide-qt | 1.17.7-0ubuntu0.14.04.1 |
| ubuntu 16.04 | chromium-browser | 52.0.2743.116-0ubuntu0.16.04.1.1250 |
| ubuntu 16.04 | oxide-qt | 1.17.7-0ubuntu0.16.04.1 |
| ubuntu 16.04-ESM | oxide-qt | 1.17.7-0ubuntu0.16.04.1 |
| ubuntu 16.10 | chromium-browser | 53.0.2785.143-0ubuntu1.1307 |
| ubuntu 16.10 | oxide-qt | 1.16.7-0ubuntu1 |
Referencias
- http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00006.html
- http://rhn.redhat.com/errata/RHSA-2016-1580.html
- http://www.debian.org/security/2016/dsa-3645
- http://www.securityfocus.com/bid/92276
- http://www.securitytracker.com/id/1036547
- https://access.redhat.com/security/cve/CVE-2016-5142
Las 16 referencias
- https://codereview.chromium.org/2141843002/
- https://crbug.com/626948
- https://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4KMX62M7UNRLWO4FEQ6YIMPMTKXXJV6A/
- https://nvd.nist.gov/vuln/detail/CVE-2016-5142
- https://security.gentoo.org/glsa/201610-09
- https://ubuntu.com/security/notices/USN-3058-1
- https://www.cve.org/CVERecord?id=CVE-2016-5142