CVE-2016-1661: Input Validation
A memory corruption flaw was found in the cross-process frames component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=601629
External References:
http://googlechromereleases.blogspot.com/2016/04/stable-channel-update28.html
Other sources
Blink, as used in Google Chrome before 50.0.2661.94, does not ensure that frames satisfy a check for the same renderer process in addition to a Same Origin Policy check, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted web site, related to BindingSecurity.cpp and DOMWindow.cpp.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Chrometo a version that resolves this vulnerability.Fixed in 50.0.2661.94 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 50.0.2661.94
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1661?
CVE-2016-1661 has been classified as a high severity vulnerability due to its potential to cause denial of service and memory corruption.
How do I fix CVE-2016-1661?
To remediate CVE-2016-1661, update Google Chrome to version 50.0.2661.94 or later.
What are the affected software versions for CVE-2016-1661?
CVE-2016-1661 affects Google Chrome versions up to 50.0.2661.87 and specific versions of Red Hat and openSUSE.
What are the potential impacts of CVE-2016-1661?
The potential impacts of CVE-2016-1661 include memory corruption and resulting denial of service attacks.
Is CVE-2016-1661 still a concern for users of older systems?
Yes, users of older systems running affected versions of Google Chrome or specific Red Hat and openSUSE distributions should address CVE-2016-1661.