CVE-2016-1696
published 2016-06-05CVE-2016-1696: The extensions subsystem in Google Chrome before 51.0.2704.79 does not properly restrict bindings access, which allows remote attackers to bypass the Same…
PriorityP341high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
1.23%
68.8th percentile
The extensions subsystem in Google Chrome before 51.0.2704.79 does not properly restrict bindings access, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| chrome | <= 51.0.2704.63 | — | |
| opensuse | leap | — | — |
| opensuse | opensuse | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
| suse | linux_enterprise | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3r8m-9qvw-p5fw: The extensions subsystem in Google Chrome before 51
ghsa_unreviewed·2022-05-14
CVE-2016-1696 [HIGH] GHSA-3r8m-9qvw-p5fw: The extensions subsystem in Google Chrome before 51
The extensions subsystem in Google Chrome before 51.0.2704.79 does not properly restrict bindings access, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
OSV
CVE-2016-1696: The extensions subsystem in Google Chrome before 51
osv·2016-06-05·CVSS 8.8
CVE-2016-1696 [HIGH] CVE-2016-1696: The extensions subsystem in Google Chrome before 51
The extensions subsystem in Google Chrome before 51.0.2704.79 does not properly restrict bindings access, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
Red Hat
chromium-browser: cross-origin bypass in extension bindings
vendor_redhat·2016-06-01·CVSS 8.8
CVE-2016-1696 [HIGH] chromium-browser: cross-origin bypass in extension bindings
chromium-browser: cross-origin bypass in extension bindings
The extensions subsystem in Google Chrome before 51.0.2704.79 does not properly restrict bindings access, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-1696 chromium-browser: cross-origin bypass in extension bindings
bugzilla·2016-06-02·CVSS 8.8
CVE-2016-1696 [HIGH] CVE-2016-1696 chromium-browser: cross-origin bypass in extension bindings
CVE-2016-1696 chromium-browser: cross-origin bypass in extension bindings
A cross-origin bypass flaw was found in the Extension bindings component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=601073
External References:
http://googlechromereleases.blogspot.com/2016/06/stable-channel-update.html
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6 Supplementary
Via RHSA-2016:1201 https://access.redhat.com/errata/RHSA-2016:1201
Bugzilla
CVE-2016-2116 jasper: memory leak in jas_iccprof_createfrombuf()
bugzilla·2016-03-03·CVSS 5.7
CVE-2016-2116 [MEDIUM] CVE-2016-2116 jasper: memory leak in jas_iccprof_createfrombuf()
CVE-2016-2116 jasper: memory leak in jas_iccprof_createfrombuf()
Memory leak in jas_iccprof_createfrombuf function in JasPer 1.900.1 and earlier was found, allowing remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file.
Vulnerable code:
src/libjasper/base/jas_icc.c:
1685 jas_iccprof_t *jas_iccprof_createfrombuf(uchar *buf, int len)
1686 {
1687 jas_stream_t *in;
1688 jas_iccprof_t *prof;
1689 if (!(in = jas_stream_memopen(JAS_CAST(char *, buf), len)))
1690 goto error;
1691 if (!(prof = jas_iccprof_load(in)))
1692 goto error;
1693 jas_stream_close(in);
1694 return prof;
1695 error:
1696 return 0;
1697 }
jas_stream_t allocated by the call to jas_stream_memopen() is leaked if jas_iccprof_load() fails on line 1691.
Prop
http://googlechromereleases.blogspot.com/2016/06/stable-channel-update.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00005.htmlhttp://www.debian.org/security/2016/dsa-3594http://www.securitytracker.com/id/1036026https://access.redhat.com/errata/RHSA-2016:1201https://codereview.chromium.org/1866103002https://crbug.com/601073http://googlechromereleases.blogspot.com/2016/06/stable-channel-update.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00005.htmlhttp://www.debian.org/security/2016/dsa-3594http://www.securitytracker.com/id/1036026https://access.redhat.com/errata/RHSA-2016:1201https://codereview.chromium.org/1866103002https://crbug.com/601073
2016-06-05
Published