CVE-2016-1669 Memory corruption in n/a
Remote attackers can cause denial of service or potential code execution via crafted JavaScript due to improper memory allocation handling in V8.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2016-1669?
CVE-2016-1669 is a high-severity memory corruption vulnerability in Canonical Ubuntu Linux, published on 14 May 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted JavaScript code.
Weakness: CWE-119
Which versions are affected by CVE-2016-1669?
It affects 6 products.
Linux distribution packages (8)
v8 Red Hat:openstack:10::el7 | All versions | 1:3.14.5.10-19.el7ost |
v8-debuginfo Red Hat:openstack:10::el7 | All versions | 1:3.14.5.10-19.el7ost |
v8 Red Hat:openstack:7::el7 | All versions | 1:3.14.5.10-19.el7ost |
v8-debuginfo Red Hat:openstack:7::el7 | All versions | 1:3.14.5.10-19.el7ost |
v8 Red Hat:openstack:8::el7 | All versions | 1:3.14.5.10-19.el7ost |
v8-debuginfo Red Hat:openstack:8::el7 | All versions | 1:3.14.5.10-19.el7ost |
v8 Red Hat:openstack:9::el7 | All versions | 1:3.14.5.10-19.el7ost |
v8-debuginfo Red Hat:openstack:9::el7 | All versions | 1:3.14.5.10-19.el7ost |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Google Chrome, Google V8, Nodejs Node.js, Opensuse Opensuse.
How do I fix CVE-2016-1669?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2016-1669 being exploited?
There is no known exploitation of CVE-2016-1669 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2016-1669, GHSA-7wg6-6952-3vfv, MGASA-2016-0307, RHSA-2017:0879, RHSA-2017:0880, RHSA-2017:0881 and 2 more.