CVE-2016-1646
High · 8.8 CISA KEVCVSS
8.8
EPSS
48.1%
Published
Mar 29, 2016
CISA due date
Jun 22, 2022
The record
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:8 | chromium-browser | 0 | 49.0.2623.108-1~deb8u1 |
| Mageia:5 | chromium-browser-stable | 0 | 49.0.2623.108-1.1.mga5 |
| Red Hat:rhel_extras:6 | chromium-browser | 0 | 0:49.0.2623.108-1.el6 |
| Red Hat:rhel_extras:6 | chromium-browser-debuginfo | 0 | 0:49.0.2623.108-1.el6 |
| Ubuntu:14.04:LTS | chromium-browser | 0 | 49.0.2623.108-0ubuntu0.14.04.1.1113 |
| Ubuntu:14.04:LTS | oxide-qt | 0 | 1.14.7-0ubuntu0.14.04.1 |
| Ubuntu:16.04:LTS | chromium-browser | 0 | 49.0.2623.108-0ubuntu1.1233 |
| Ubuntu:16.04:LTS | libv8-3.14 | 0 | No fix |
| Ubuntu:16.04:LTS | oxide-qt | 0 | 1.14.7-0ubuntu1 |
| Ubuntu:18.04:LTS | libv8-3.14 | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | libv8-3.14 | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | libv8-3.14 | 0 | No fix |
| openSUSE:Tumbleweed | chromium | 0 | 55.0.2883.75-3.1 |
| openSUSE:Tumbleweed | chromium | 0 | 113.0.5672.92-1.1 |
Related vulnerabilities
- CVE-2016-9651 A missing check for whether a property of a JS object is private in V8 in Google Chrome… Also affects chromium-browser
- CVE-2017-5029 The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in… Also affects chromium-browser
- CVE-2017-5040 V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108… Also affects chromium-browser
- CVE-2017-5030 Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for… Also affects chromium-browser
- CVE-2017-5006 Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87… Also affects chromium-browser
- CVE-2016-5198 V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and… Also affects chromium-browser
- CVE-2016-5204 Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google… Also affects chromium-browser
- CVE-2016-5170 WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google… Also affects chromium-browser