8.8high
CVE-2016-1646KEVin critical feed
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly con…
Published 10 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.1 · CNA
CISA KEV
Yes
added 2022-06-08
EPSS
48.1%
percentile 99%
Public exploits
0
none known
Summary
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.
Known exploited (CISA KEV)
- Added
- 4 y ago
- Due date
- 2022-06-22 (4 y ago)
- Ransomware use
- Unknown
- Required action
- Apply updates per vendor instructions.
- Vendor / product
- Google / Chromium V8
- CISA name
- Google Chromium V8 Out-of-Bounds Read Vulnerability
CISA SSVC assessment
- Exploitation
- Active — exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 21 mo ago
Exploit prediction (EPSS)
48.11% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
- CWE-125 Out-of-bounds Read
- Technology feeds
- Google Chrome (RSS, critical only)
References
- rhn.redhat.com /errata/RHSA-2016-0525.html · vendor-advisory, x_refsource_REDHAT, x_transferred
- lists.opensuse.org /opensuse-security-announce/2016-04/msg00000.html · vendor-advisory, x_refsource_SUSE, x_transferred
- lists.opensuse.org /opensuse-security-announce/2016-04/msg00039.html · vendor-advisory, x_refsource_SUSE, x_transferred
- googlechromereleases.blogspot.com /2016/03/stable-channel-update_24.html · x_refsource_CONFIRM, x_transferred
- debian.org /security/2016/dsa-3531 · vendor-advisory, x_refsource_DEBIAN, x_transferred
- codereview.chromium.org /1804963002/ · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1035423 · vdb-entry, x_refsource_SECTRACK, x_transferred
- lists.opensuse.org /opensuse-security-announce/2016-04/msg00001.html · vendor-advisory, x_refsource_SUSE, x_transferred
- code.google.com /p/chromium/issues/detail?id=594574 · x_refsource_CONFIRM, x_transferred
- ubuntu.com /usn/USN-2955-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
- security.gentoo.org /glsa/201605-02 · vendor-advisory, x_refsource_GENTOO, x_transferred
- cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1646 · government-resource
Sources
- CVE List: CVE-2016-1646
- NVD: CVE-2016-1646
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.