CVE-2016-1678
published 2016-06-05CVE-2016-1678: objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote…
PriorityP337high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
1.64%
73.6th percentile
objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JavaScript code.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| chrome | <= 50.0.2661.102 | — | |
| v8 | <= 5.0.71 | — | |
| opensuse | leap | — | — |
| opensuse | opensuse | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
| suse | linux_enterprise | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Oxide vulnerabilities
vendor_ubuntu·2016-06-06·CVSS 8.8
CVE-2016-1673 [HIGH] Oxide vulnerabilities
Title: Oxide vulnerabilities
Summary: Several security issues were fixed in Oxide.
An unspecified security issue was discovered in Blink. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to bypass same-origin restrictions.
(CVE-2016-1673)
An issue was discovered with Document reattachment in Blink in some
circumstances. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to bypass same-origin
restrictions. (CVE-2016-1675)
A type confusion bug was discovered in V8. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to obtain sensitive information. (CVE-2016-1677)
A heap overflow was discovered in V8. If a user wer
Red Hat
chromium-browser: heap overflow in v8
vendor_redhat·2016-05-25·CVSS 8.8
CVE-2016-1678 [HIGH] chromium-browser: heap overflow in v8
chromium-browser: heap overflow in v8
objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JavaScript code.
GHSA
GHSA-49h6-3xq9-p7m8: objects
ghsa_unreviewed·2022-05-14
CVE-2016-1678 [HIGH] CWE-119 GHSA-49h6-3xq9-p7m8: objects
objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JavaScript code.
OSV
oxide-qt vulnerabilities
osv·2016-06-06·CVSS 8.8
CVE-2016-1673 [HIGH] oxide-qt vulnerabilities
oxide-qt vulnerabilities
An unspecified security issue was discovered in Blink. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to bypass same-origin restrictions.
(CVE-2016-1673)
An issue was discovered with Document reattachment in Blink in some
circumstances. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to bypass same-origin
restrictions. (CVE-2016-1675)
A type confusion bug was discovered in V8. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to obtain sensitive information. (CVE-2016-1677)
A heap overflow was discovered in V8. If a user were tricked in to opening
a specially crafted website, an att
OSV
CVE-2016-1678: objects
osv·2016-05-31·CVSS 8.8
CVE-2016-1678 [HIGH] CVE-2016-1678: objects
objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JavaScript code.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-1678 chromium-browser: heap overflow in v8
bugzilla·2016-05-26·CVSS 8.8
CVE-2016-1678 [HIGH] CVE-2016-1678 chromium-browser: heap overflow in v8
CVE-2016-1678 chromium-browser: heap overflow in v8
A heap overflow flaw was found in the V8 component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=595259
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6 Supplementary
Via RHSA-2016:1190 https://access.redhat.com/errata/RHSA-2016:1190
Checkpoint
25th January – Threat Intelligence Report
blogs_checkpoint·2021-01-25
CVE-2021-1678 25th January – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 25th January – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 25th January, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
The CHwapi hospital in Belgium has been hit by BitLocker, encrypting 40 of its servers and 100 TB of data. The attack caused the hospital to redirect patients and delay surgical procedures.
Check Point SandBlast Agent provides protection against this threat
Cybersecurity firm SonicWall has suffered an attack on its inte
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00005.htmlhttp://www.debian.org/security/2016/dsa-3590http://www.securityfocus.com/bid/90876http://www.securitytracker.com/id/1035981http://www.ubuntu.com/usn/USN-2992-1https://access.redhat.com/errata/RHSA-2016:1190https://codereview.chromium.org/1875053002https://crbug.com/595259https://security.gentoo.org/glsa/201607-07http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00005.htmlhttp://www.debian.org/security/2016/dsa-3590http://www.securityfocus.com/bid/90876http://www.securitytracker.com/id/1035981http://www.ubuntu.com/usn/USN-2992-1https://access.redhat.com/errata/RHSA-2016:1190https://codereview.chromium.org/1875053002https://crbug.com/595259https://security.gentoo.org/glsa/201607-07
2016-06-05
Published