CVE-2016-1624 Integer underflow in the ProcessCommandsInternal function in dec/decode.c in Brotli, as used in Google Chrome before 48.0.2564.109, allows remote attackers to cause a denial of service (buffer overflo...
HighCVSS 8.8
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer underflow in the ProcessCommandsInternal function in dec/decode.c in Brotli, as used in Google Chrome before 48.0.2564.109, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted data with brotli compression.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/brotli(Debian:12) | < 0.3.0+dfsg-3 | 0.3.0+dfsg-3 |
| debian/brotli(Debian:13) | < 0.3.0+dfsg-3 | 0.3.0+dfsg-3 |
| debian/brotli(Debian:14) | < 0.3.0+dfsg-3 | 0.3.0+dfsg-3 |
| opensuse | = 13.1 | No fix listed |
| Google Chrome | <= 48.0.2564.103 | No fix listed |
| debian linux | = 8.0 | No fix listed |
References
- Debian Security Tracker CVE-2016-1624 vendor-advisory
- googlechromereleases.blogspot.com
- openSUSE-SU-2016:0491 vendor-advisory
- openSUSE-SU-2016:0518 vendor-advisory
- RHSA-2016:0241 vendor-advisory
- DSA-3486 vendor-advisory
- 83125 vdb-entry
- 1035183 vdb-entry
- USN-2895-1 vendor-advisory
- code.google.com
- codereview.chromium.org
- GLSA-201603-09 vendor-advisory
- bugs.debian.org issue-tracking