CVE-2016-9080
Critical · 9.8CVSS
9.8
EPSS
2.3%
Published
Jun 11, 2018
CISA due date
—
Cloudanix analysis
A flaw in the browser lets attackers run their own programs on a user's computer simply by getting the user to visit a malicious website.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Moderate
- Impact
- Remote Code Execution
- Component
- Application
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Memory corruption flaws in the browser engine allow an attacker to overwrite memory and achieve arbitrary code execution.
Why it matters to the business
Attackers can take full control of affected user systems, leading to data theft, ransomware deployment, or use of machines in larger attacks; the issue affects widely deployed Chromium packages across Debian and Ubuntu releases.
How an attack unfolds
An attacker hosts or delivers a malicious webpage that triggers one of the memory safety bugs; with sufficient effort the corruption is turned into code execution inside the browser process.
How to fix it
Upgrade affected Chromium packages to the listed fixed versions: chromium 71.0.3578.80-1 on Debian 11/12/13 and chromium-browser 71.0.3578.80-0ubuntu0.16.04.1 on Ubuntu 16.04 LTS.
How to confirm the fix worked
Confirm the installed browser package version matches or exceeds the fixed releases; re-test with known memory-safety test cases or updated browser security suites.
Typical attack path
- Deliver a malicious webpage or crafted content to the victim
- Trigger memory corruption in the browser's rendering or scripting engine
- Leverage the corruption to execute arbitrary native code
- Establish persistence or exfiltrate data from the compromised system
How to detect it
Review web proxy and browser process logs for unexpected crashes or unusual memory allocation patterns around the time of suspected exploitation; correlate with known malicious page delivery indicators.
What your security team should do
- Immediately update all listed Chromium packages to the fixed versions
- Block or sandbox untrusted web content until patches are applied
- Monitor for post-patch memory corruption reports in browser telemetry
The record
Memory safety bugs were reported in Firefox 50.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:5 | iceape | 0 | 2.48-1.mga5 |
| Mageia:6 | iceape | 0 | 2.48-1.mga6 |
| Ubuntu:14.04:LTS | firefox | 0 | 50.1.0+build2-0ubuntu0.14.04.1 |
| Ubuntu:16.04:LTS | firefox | 0 | 50.1.0+build2-0ubuntu0.16.04.1 |
| openSUSE:Tumbleweed | MozillaFirefox | 0 | 50.1.0-1.1 |
| openSUSE:Tumbleweed | firefox-esr | 0 | 128.5.1-1.1 |
Related vulnerabilities
- CVE-2017-7826 Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4. Also affects iceape
- CVE-2017-7805 During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. Also affects iceape
- CVE-2017-7810 Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3. Also affects iceape
- CVE-2017-7793 A use-after-free vulnerability can occur in the Fetch API when the worker or the… Also affects iceape
- CVE-2017-7753 An out-of-bounds read occurs when applying style rules to pseudo-elements, such as… Also affects iceape
- CVE-2017-5465 An out-of-bounds read while processing SVG content in "ConvolvePixel". Also affects iceape
- CVE-2017-5470 Memory safety bugs were reported in Firefox 53 and Firefox ESR 52.1. Also affects iceape
- CVE-2017-5447 An out-of-bounds read during the processing of glyph widths during text layout. Also affects iceape