CVE-2016-5142 The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which allows remote attackers to cause a denial of...
CriticalCVSS 9.8
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code, related to NormalizeAlgorithm.cpp and SubtleCrypto.cpp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Google Chrome | <= 52.0.2743.82 | No fix listed |
References
- googlechromereleases.blogspot.com
- openSUSE-SU-2016:1982 vendor-advisory
- openSUSE-SU-2016:1983 vendor-advisory
- RHSA-2016:1580 vendor-advisory
- DSA-3645 vendor-advisory
- 92276 vdb-entry
- 1036547 vdb-entry
- codereview.chromium.org
- crbug.com
- FEDORA-2016-e9798eaaa3 vendor-advisory
- GLSA-201610-09 vendor-advisory