ID CVE-2016-1644
Summary WebKit/Source/core/layout/LayoutObject.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly restrict relayout scheduling, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted HTML document.
References
Vulnerable Configurations
  • Google Chrome 49.0.2623.75
    cpe:2.3:a:google:chrome:49.0.2623.75
CVSS
Base: 9.3 (as of 18-03-2016 - 13:20)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
nessus via4
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3513.NASL
    description Several vulnerabilities have been discovered in the chromium web browser. - CVE-2016-1643 cloudfuzzer discovered a type confusion issue in Blink/Webkit. - CVE-2016-1644 Atte Kettunen discovered a use-after-free issue in Blink/Webkit. - CVE-2016-1645 An out-of-bounds write issue was discovered in the pdfium library.
    last seen 2018-09-01
    modified 2018-07-10
    plugin id 89851
    published 2016-03-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=89851
    title Debian DSA-3513-1 : chromium-browser - security update
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-364.NASL
    description This update contains Chromium 49.0.2623.87 to fix the following issues : - CVE-2016-1643: Type confusion in Blink (boo#970514) - CVE-2016-1644: Use-after-free in Blink (boo#970509) - CVE-2016-1645: Out-of-bounds write in PDFium (boo#970511)
    last seen 2018-09-01
    modified 2016-10-13
    plugin id 90056
    published 2016-03-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=90056
    title openSUSE Security Update : Chromium (openSUSE-2016-364)
  • NASL family Windows
    NASL id GOOGLE_CHROME_49_0_2623_87.NASL
    description The version of Google Chrome installed on the remote Windows host is prior to 49.0.2623.87. It is, therefore, affected by multiple vulnerabilities : - A type confusion error exists in the Blink rendering engine that allows a remote attacker, via a malicious website, to execute arbitrary code. (CVE-2016-1643) - A use-after-free error exists in the Blink rendering engine that allows a remote attacker, via a malicious website, to deference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-1644) - An out-of-bounds write error exists in PDFium, the PDF rendering library, that allows a remote attacker to manipulate the system memory, resulting the execution of arbitrary code. (CVE-2016-1645)
    last seen 2018-09-01
    modified 2018-07-12
    plugin id 89786
    published 2016-03-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=89786
    title Google Chrome < 49.0.2623.87 Multiple RCE
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_5C288F68C7CA4C0DB7DC1EC6295200B3.NASL
    description Google Chrome Releases reports : [589838] High CVE-2016-1643: Type confusion in Blink. [590620] High CVE-2016-1644: Use-after-free in Blink. [587227] High CVE-2016-1645: Out-of-bounds write in PDFium.
    last seen 2018-09-02
    modified 2016-10-19
    plugin id 90288
    published 2016-04-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=90288
    title FreeBSD : chromium -- multiple vulnerabilities (5c288f68-c7ca-4c0d-b7dc-1ec6295200b3)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_GOOGLE_CHROME_49_0_2623_87.NASL
    description The version of Google Chrome installed on the remote Mac OS X host is prior to 49.0.2623.87. It is, therefore, affected by multiple vulnerabilities : - A type confusion error exists in the Blink rendering engine that allows a remote attacker, via a malicious website, to execute arbitrary code. (CVE-2016-1643) - A use-after-free error exists in the Blink rendering engine that allows a remote attacker, via a malicious website, to deference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-1644) - An out-of-bounds write error exists in PDFium, the PDF rendering library, that allows a remote attacker to manipulate the system memory, resulting the execution of arbitrary code. (CVE-2016-1645)
    last seen 2018-09-02
    modified 2018-07-14
    plugin id 89787
    published 2016-03-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=89787
    title Google Chrome < 49.0.2623.87 Multiple RCE
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2920-1.NASL
    description It was discovered that the ContainerNode::parserRemoveChild function in Blink mishandled widget updates in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2016-1630) It was discovered that the PPB_Flash_MessageLoop_Impl::InternalRun function in Chromium mishandled nested message loops. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2016-1631) Multiple use-after-frees were discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2016-1633, CVE-2016-1634, CVE-2016-1644) It was discovered that the PendingScript::notifyFinished function in Blink relied on memory-cache information about integrity-check occurrences instead of integrity-check successes. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass Subresource Integrity (SRI) protections. (CVE-2016-1636) It was discovered that the SkATan2_255 function in Skia mishandled arctangent calculations. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2016-1637) A use-after-free was discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking the program. (CVE-2016-1641) Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. (CVE-2016-1642) A type-confusion bug was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2016-1643) Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2016-2843) An invalid cast was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2016-2844) It was discovered that the Content Security Policy (CSP) implementation in Blink did not ignore a URL's path component in the case of a ServiceWorker fetch. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2016-2845). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-09-01
    modified 2018-08-03
    plugin id 89865
    published 2016-03-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=89865
    title Ubuntu 14.04 LTS / 15.10 : oxide-qt vulnerabilities (USN-2920-1)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-362.NASL
    description This update contains Chromium 49.0.2623.87 to fix the following issues : - CVE-2016-1643: Type confusion in Blink (boo#970514) - CVE-2016-1644: Use-after-free in Blink (boo#970509) - CVE-2016-1645: Out-of-bounds write in PDFium (boo#970511)
    last seen 2018-09-01
    modified 2016-10-13
    plugin id 90055
    published 2016-03-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=90055
    title openSUSE Security Update : Chromium (openSUSE-2016-362)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2016-0429.NASL
    description Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Chromium is an open source web browser, powered by WebKit (Blink). Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-1643, CVE-2016-1644, CVE-2016-1645) All Chromium users should upgrade to these updated packages, which contain Chromium version 49.0.2623.87, which corrects these issues. After installing the update, Chromium must be restarted for the changes to take effect.
    last seen 2018-09-07
    modified 2018-09-06
    plugin id 89821
    published 2016-03-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=89821
    title RHEL 6 : chromium-browser (RHSA-2016:0429)
redhat via4
rpms chromium-browser-0:49.0.2623.87-1.el6
refmap via4
bid 84224
confirm
debian DSA-3513
sectrack 1035259
suse
  • openSUSE-SU-2016:0817
  • openSUSE-SU-2016:0818
  • openSUSE-SU-2016:0828
ubuntu USN-2920-1
Last major update 02-12-2016 - 22:21
Published 13-03-2016 - 18:59
Back to Top