Vulnerability Name: | CVE-2016-1702 (CCN-113731) | ||||||||||||||||||||||||||||||||||||||||
Assigned: | 2016-06-01 | ||||||||||||||||||||||||||||||||||||||||
Published: | 2016-06-01 | ||||||||||||||||||||||||||||||||||||||||
Updated: | 2018-10-30 | ||||||||||||||||||||||||||||||||||||||||
Summary: | The SkRegion::readFromMemory function in core/SkRegion.cpp in Skia, as used in Google Chrome before 51.0.2704.79, does not validate the interval count, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted serialized data. | ||||||||||||||||||||||||||||||||||||||||
CVSS v3 Severity: | 6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) 5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
5.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||
CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
| ||||||||||||||||||||||||||||||||||||||||
Vulnerability Type: | CWE-119 | ||||||||||||||||||||||||||||||||||||||||
Vulnerability Consequences: | Gain Access | ||||||||||||||||||||||||||||||||||||||||
References: | Source: MITRE Type: CNA CVE-2016-1702 Source: CCN Type: Google Chrome Releases Web site Stable Channel Update Source: CONFIRM Type: Vendor Advisory http://googlechromereleases.blogspot.com/2016/06/stable-channel-update.html Source: SUSE Type: Third Party Advisory openSUSE-SU-2016:1489 Source: SUSE Type: Third Party Advisory SUSE-SU-2016:1490 Source: SUSE Type: Third Party Advisory openSUSE-SU-2016:1496 Source: CCN Type: RHSA-2016-1201 Important: chromium-browser security update Source: DEBIAN Type: Third Party Advisory DSA-3594 Source: SECTRACK Type: Third Party Advisory 1036026 Source: UBUNTU Type: Third Party Advisory USN-2992-1 Source: REDHAT Type: Third Party Advisory RHSA-2016:1201 Source: CONFIRM Type: Issue Tracking https://codereview.chromium.org/1961463003 Source: CONFIRM Type: Permissions Required https://crbug.com/609260 Source: XF Type: UNKNOWN google-chrome-cve20161702-code-exec(113731) Source: CCN Type: WhiteSource Vulnerability Database CVE-2016-1702 | ||||||||||||||||||||||||||||||||||||||||
Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration CCN 1: ![]() | ||||||||||||||||||||||||||||||||||||||||
Oval Definitions | |||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||
BACK |