CVE-2016-5200: Buffer Overflow

Q: What is the severity of CVE-2016-5200?

CVE-2016-5200 has a base severity score of 7.5, indicating high severity due to the potential for remote code execution.

Q: How do I fix CVE-2016-5200?

To fix CVE-2016-5200, update Google Chrome to the latest version available, which addresses the type rule vulnerability.

Q: What are the affected versions of Google Chrome for CVE-2016-5200?

CVE-2016-5200 affects Google Chrome versions prior to 54.0.2840.98 for Mac, 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux.

Q: Can CVE-2016-5200 be exploited by a remote attacker?

Yes, CVE-2016-5200 allows a remote attacker to potentially exploit heap corruption through a specially crafted HTML page.

Q: What type of vulnerability is CVE-2016-5200 classified as?

CVE-2016-5200 is classified as a type confusion vulnerability in the V8 JavaScript engine of Google Chrome.

Published Nov 10, 2016

Updated

An out of bounds memory access flaw was found in the V8 component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=658114

External References:

https://googlechromereleases.blogspot.com/2016/11/stable-channel-update-for-desktop9.html

Other sources

V8 in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android incorrectly applied type rules, which allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

— MITRE

Affected Software

2 affected componentsFixes available

Google Chrome<=54.0.2840.87

redhat/chrome<54.0.2840.99

54.0.2840.99

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/Chrome to a version that resolves this vulnerability.
Fixed in 54.0.2840.99
Upgrade
Upgrade Google Chrome for Mac to a version that resolves this vulnerability.
Fixed in 54.0.2840.98
Upgrade
Upgrade Google Chrome for Windows to a version that resolves this vulnerability.
Fixed in 54.0.2840.99
Upgrade
Upgrade Google Chrome for Linux to a version that resolves this vulnerability.
Fixed in 54.0.2840.100
Upgrade
Upgrade Google Chrome for Android to a version that resolves this vulnerability.
Fixed in 55.0.2883.84

Event History

Nov 10, 2016

Data Sourced

via Red Hat·08:53 AM

DescriptionSeverityAffected Software

Jan 19, 2017

CVE Published

via MITRE·05:43 AM

Data Sourced

via MITRE·05:43 AM

DescriptionWeakness

Data Sourced

via NVD·05:59 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2016-5200?

CVE-2016-5200 has a base severity score of 7.5, indicating high severity due to the potential for remote code execution.

How do I fix CVE-2016-5200?

To fix CVE-2016-5200, update Google Chrome to the latest version available, which addresses the type rule vulnerability.

What are the affected versions of Google Chrome for CVE-2016-5200?

CVE-2016-5200 affects Google Chrome versions prior to 54.0.2840.98 for Mac, 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux.

Can CVE-2016-5200 be exploited by a remote attacker?

Yes, CVE-2016-5200 allows a remote attacker to potentially exploit heap corruption through a specially crafted HTML page.

What type of vulnerability is CVE-2016-5200 classified as?

CVE-2016-5200 is classified as a type confusion vulnerability in the V8 JavaScript engine of Google Chrome.

CVE-2016-5200: Buffer Overflow

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2016-5200?

How do I fix CVE-2016-5200?

What are the affected versions of Google Chrome for CVE-2016-5200?

Can CVE-2016-5200 be exploited by a remote attacker?

What type of vulnerability is CVE-2016-5200 classified as?

Company

Resources

Contact