CVE-2016-1660: Information leak in V8. Credit to HyungSeok Han.
An out-of-bounds write flaw was found in the Blink component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=574802
External References:
http://googlechromereleases.blogspot.com/2016/04/stable-channel-update28.html
Other sources
Blink, as used in Google Chrome before 50.0.2661.94, mishandles assertions in the WTF::BitArray and WTF::doubleconversion::Vector classes, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted web site.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Chrometo a version that resolves this vulnerability.Fixed in 50.0.2661.94 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 50.0.2661.94
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2016-1660?
CVE-2016-1660 has been classified as a high-severity vulnerability due to its potential for causing denial of service.
How do I fix CVE-2016-1660?
To fix CVE-2016-1660, update Google Chrome to the latest version that exceeds 50.0.2661.94.
What software is affected by CVE-2016-1660?
CVE-2016-1660 affects multiple versions of Google Chrome and several Red Hat Enterprise Linux distributions.
What type of attack does CVE-2016-1660 facilitate?
CVE-2016-1660 facilitates remote attackers in executing denial of service attacks through crafted web content.
What specific components are involved in CVE-2016-1660 vulnerability?
CVE-2016-1660 involves mishandling assertions in the WTF::BitArray and WTF::double_conversion::Vector classes within the Blink rendering engine.