Google Chrome V8 <49.0.2623.108代码执行漏洞

详细信息

漏洞类型

缓冲区错误

漏洞描述

Google Chrome是美国谷歌（Google）公司开发的一款Web浏览器。Google V8是其中的一套开源JavaScript引擎。Google Chrome 49.0.2623.95及之前版本中使用的Google V8中的builtins.cc文件中的Array.prototype.concat实现过程中存在安全漏洞，该漏洞源于程序没有正确考虑元素数据类型。远程攻击者可借助特制的JavaScript代码利用该漏洞造成拒绝服务（越边界读取）。

修复建议

从Google网站升级至Chrome的最新版本（49.0.2623.108或更高版本）： http://googlechromereleases.blogspot.com/2016/03/stable-channel-update_24.html

参考链接

• http://googlechromereleases.blogspot.com/2016/03/stable-channel-update_24.html

  NVD · x_refsource_CONFIRM

• https://codereview.chromium.org/1804963002/

  NVD · x_refsource_CONFIRM

• https://code.google.com/p/chromium/issues/detail?id=594574

  NVD · x_refsource_CONFIRM

• http://www.debian.org/security/2016/dsa-3531

  NVD · vendor-advisory · x_refsource_DEBIAN

• http://rhn.redhat.com/errata/RHSA-2016-0525.html

  NVD · vendor-advisory · x_refsource_REDHAT

• http://www.ubuntu.com/usn/USN-2955-1

  NVD · vendor-advisory · x_refsource_UBUNTU

• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00000.html

  NVD · vendor-advisory · x_refsource_SUSE

• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00039.html

  NVD · vendor-advisory · x_refsource_SUSE

• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00001.html

  NVD · vendor-advisory · x_refsource_SUSE

• https://security.gentoo.org/glsa/201605-02

  NVD · vendor-advisory · x_refsource_GENTOO

• https://osv.dev/vulnerability/DSA-3531-1

  OSV

• https://ubuntu.com/security/CVE-2016-1646

  OSV

• http://googlechromereleases.blogspot.com/2016/03/

  OSV

• https://ubuntu.com/security/notices/USN-2955-1

  OSV

• https://www.cve.org/CVERecord?id=CVE-2016-1646

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  OSV

• https://osv.dev/vulnerability/UBUNTU-CVE-2016-1646

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1646

  NVD · US Government Resource