CVE-2016-5142 — Use After Free in Google Chrome

CWE-416 — Use After Free9 documents6 sources
Severity
9.8CRITICALNVD
OSV7.5OSV5.9
EPSS
2.8%
top 13.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SambaGoogle Chrome
Timeline
PublishedAug 7
Latest updateMay 17

Description

The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code, related to NormalizeAlgorithm.cpp and SubtleCrypto.cpp.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDgoogle/chrome52.0.2743.82
▶Ubuntusamba/samba< 2:4.13.14+dfsg-0ubuntu0.20.04.4+1

🔴Vulnerability Details

5
GHSA
GHSA-g54g-mw8m-9fqx: The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52↗2022-05-17
▶
OSV
samba regression↗2021-12-13
▶
OSV
samba regressions↗2021-12-06
▶
OSV
oxide-qt vulnerabilities↗2016-09-14
▶
OSV
CVE-2016-5142: The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52↗2016-08-07
▶

📋Vendor Advisories

2
Ubuntu
Oxide vulnerabilities↗2016-09-14
▶
Red Hat
chromium-browser: Use-after-free in Blink↗2016-08-03
▶

💬Community

1
Bugzilla
CVE-2016-5142 chromium-browser: Use-after-free in Blink↗2016-08-04
▶