CVE-2016-5161
published 2016-09-11CVE-2016-5161: The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X…
PriorityP432high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
1.40%
69.4th percentile
The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles custom properties, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site that leverages "type confusion" in the StylePropertySerializer class.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | <= 52.0.2743.116 | — | |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9fvw-rxr2-xxw3: The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle
ghsa_unreviewed·2022-05-14
CVE-2016-5161 [HIGH] CWE-704 GHSA-9fvw-rxr2-xxw3: The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle
The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles custom properties, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site that leverages "type confusion" in the StylePropertySerializer class.
OSV
oxide-qt vulnerabilities
osv·2016-09-14·CVSS 7.5
CVE-2016-5141 [HIGH] oxide-qt vulnerabilities
oxide-qt vulnerabilities
An issue was discovered in Blink involving the provisional URL for an
initially empty document. An attacker could potentially exploit this to
spoof the currently displayed URL. (CVE-2016-5141)
A use-after-free was discovered in the WebCrypto implementation in Blink.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code. (CVE-2016-5142)
It was discovered that the devtools subsystem in Blink mishandles various
parameters. An attacker could exploit this to bypass intended access
restrictions. (CVE-2016-5143, CVE-2016-5144)
It was discovered that Blink does not ensure that a taint property is
preserved after a structure-clone operatio
OSV
CVE-2016-5161: The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle
osv·2016-09-02·CVSS 8.8
CVE-2016-5161 [HIGH] CVE-2016-5161: The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle
The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles custom properties, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site that leverages "type confusion" in the StylePropertySerializer class.
Ubuntu
Oxide vulnerabilities
vendor_ubuntu·2016-09-14·CVSS 7.5
CVE-2016-5141 [HIGH] Oxide vulnerabilities
Title: Oxide vulnerabilities
Summary: Several security issues were fixed in Oxide.
An issue was discovered in Blink involving the provisional URL for an
initially empty document. An attacker could potentially exploit this to
spoof the currently displayed URL. (CVE-2016-5141)
A use-after-free was discovered in the WebCrypto implementation in Blink.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code. (CVE-2016-5142)
It was discovered that the devtools subsystem in Blink mishandles various
parameters. An attacker could exploit this to bypass intended access
restrictions. (CVE-2016-5143, CVE-2016-5144)
It was discovered that Blink does not ensure that a t
Red Hat
chromium-browser: type confusion in blink
vendor_redhat·2016-08-31·CVSS 8.8
CVE-2016-5161 [HIGH] chromium-browser: type confusion in blink
chromium-browser: type confusion in blink
The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles custom properties, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site that leverages "type confusion" in the StylePropertySerializer class.
No detection rules found.
No public exploits indexed.
Bugzilla
chromium: various flaws [fedora-all]
bugzilla·2016-09-01·CVSS 6.1
[MEDIUM] chromium: various flaws [fedora-all]
chromium: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has b
Bugzilla
CVE-2016-5161 chromium-browser: type confusion in blink
bugzilla·2016-09-01·CVSS 8.8
CVE-2016-5161 [HIGH] CVE-2016-5161 chromium-browser: type confusion in blink
CVE-2016-5161 chromium-browser: type confusion in blink
A type confusion flaw was found in the Blink component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=622420
External References:
https://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop_31.html
Discussion:
Created chromium tracking bugs for this issue:
Affects: fedora-all [bug 1372232]
---
chromium-53.0.2785.101-1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6 Supplementary
Via RHSA-2016:1854 https://rhn.redhat.com/errata/RHSA-2016-1854.html
---
chromium-53.0.2785.101-1.fc25 has b
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00008.htmlhttp://lists.opensuse.org/opensuse-updates/2016-09/msg00073.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1854.htmlhttp://www.debian.org/security/2016/dsa-3660http://www.securityfocus.com/bid/92717http://www.securitytracker.com/id/1036729http://zerodayinitiative.com/advisories/ZDI-16-501/https://codereview.chromium.org/2103043004https://crbug.com/622420https://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop_31.htmlhttps://security.gentoo.org/glsa/201610-09http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00008.htmlhttp://lists.opensuse.org/opensuse-updates/2016-09/msg00073.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1854.htmlhttp://www.debian.org/security/2016/dsa-3660http://www.securityfocus.com/bid/92717http://www.securitytracker.com/id/1036729http://zerodayinitiative.com/advisories/ZDI-16-501/https://codereview.chromium.org/2103043004https://crbug.com/622420https://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop_31.htmlhttps://security.gentoo.org/glsa/201610-09
2016-09-11
Published