CVE-2016-5202: Critical severity Google Chrome vulnerability
browser/extensions/api/dial/dialregistry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux neglects to copy a device ID before an erase() call, which causes the erase operation to access data that that erase operation will destroy.
Other sources
Various fixes from internal audits, fuzzing and other initiatives.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=662843
External References:
https://googlechromereleases.blogspot.com/2016/11/stable-channel-update-for-desktop9.html
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 54.0.2840.99 - Upgrade
Upgrade
redhat/Chrometo a version that resolves this vulnerability.Fixed in 54.0.2840.99 - Upgrade
Upgrade
Google Chrome on macOSto a version that resolves this vulnerability.Fixed in 54.0.2840.98 - Upgrade
Upgrade
Google Chrome on Windowsto a version that resolves this vulnerability.Fixed in 54.0.2840.99 - Upgrade
Upgrade
Google Chrome on Linuxto a version that resolves this vulnerability.Fixed in 54.0.2840.100
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2016-5202?
CVE-2016-5202 is classified as a medium severity vulnerability in Google Chrome.
How do I fix CVE-2016-5202?
To fix CVE-2016-5202, update Google Chrome to version 54.0.2840.99 or later.
Which versions of Google Chrome are affected by CVE-2016-5202?
CVE-2016-5202 affects Google Chrome versions prior to 54.0.2840.99 on Windows and macOS, and 54.0.2840.100 on Linux.
What platforms are impacted by CVE-2016-5202?
CVE-2016-5202 impacts Google Chrome on Windows, macOS, and Linux.
What type of vulnerability is CVE-2016-5202?
CVE-2016-5202 is a memory corruption vulnerability related to device ID handling in Google Chrome.