CVE-2016-5199: Buffer Overflow
A heap corruption flaw was found in the FFmpeg component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=643948
External References:
https://googlechromereleases.blogspot.com/2016/11/stable-channel-update-for-desktop9.html
Other sources
An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted video file.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 54.0.2840.99 - Upgrade
Upgrade
redhat/Chrometo a version that resolves this vulnerability.Fixed in 54.0.2840.99 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 54.0.2840.98 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 54.0.2840.99 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 54.0.2840.100 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 55.0.2883.84
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2016-5199?
CVE-2016-5199 is classified as a critical security vulnerability due to its potential for remote code execution via crafted video files.
How do I fix CVE-2016-5199?
To mitigate CVE-2016-5199, users should update Google Chrome to version 54.0.2840.99 or later.
What platforms are affected by CVE-2016-5199?
CVE-2016-5199 affects Google Chrome on Mac, Windows, Linux, and Android platforms.
What kind of attack can exploit CVE-2016-5199?
CVE-2016-5199 can be exploited by a remote attacker through a specially crafted video file causing heap corruption.
Is there a workaround for CVE-2016-5199?
There is no specific workaround for CVE-2016-5199; the best defense is to update to the latest version of Google Chrome.