CVE-2016-1669
HighSummary
The Zone::New function in Google V8 before version 5.0.71.47 and in Google Chrome before version 50.0.2661.102 does not properly determine when to expand certain memory allocations. This can lead to denial of service (buffer overflow) or other unspecified impacts via crafted JavaScript code.
Risk Assessment
Remote attackers may exploit this vulnerability to cause denial of service, affecting the availability of the application or system. There is also a risk of unspecified impacts that could threaten data security.
Recommendation
It is recommended to update Google V8 to version 5.0.71.47 or later and Google Chrome to version 50.0.2661.102 or later to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Google V8, Google Chrome
See all- CVE-2016-5129High
Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objects, allowing remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code.
- CVE-2016-5128High
In Google V8 before version 5.2.361.27 and in Google Chrome before version 52.0.2743.82, there is a vulnerability that allows API interceptors to modify a store target without setting a property. This enables remote attackers to bypass the Same Origin Policy via a crafted website.
- CVE-2016-1653High
The LoadBuffer implementation in Google V8, used in Google Chrome before version 50.0.2661.75, mishandles data types, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers an out-of-bounds write operation.
- CVE-2016-1612High
The LoadIC::UpdateCaches function in Google V8, used in Google Chrome before version 48.0.2564.82, does not ensure receiver compatibility before performing a cast of an unspecified variable. This allows remote attackers to cause a denial of service or possibly have unknown other impact via crafted JavaScript code.
- CVE-2015-3910High
Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2015-3333High
Multiple unspecified vulnerabilities in Google V8 before 4.2.77.14, as used in Google Chrome before 42.0.2311.90, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2015-1242High
The ReduceTransitionElementsKind function in Google V8 before version 4.2.77.8, as used in Google Chrome before version 42.0.2311.90, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that leverages 'type confusion' in the check-elimination optimization.
- CVE-2015-2238High
Multiple unspecified vulnerabilities in Google V8 before version 4.1.0.21, as used in Google Chrome before version 41.0.2272.76, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2015-1346High
Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2014-7967High
Multiple unspecified vulnerabilities in Google V8 before version 3.28.71.15, as used in Google Chrome before version 38.0.2125.101, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Original NVD description (English source)
The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted JavaScript code.