CVE-2016-1677

MEDIUM

Google V8 <5.1.281.26 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-1677. PoCs published by OpenSISE.

Description

uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain sensitive information by calling the decodeURI function and leveraging "type confusion."

Exploits (1)

References (12)

Core 12
Core References
Issue Tracking x_refsource_confirm
https://crbug.com/602970
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/90876
Patch x_refsource_confirm
https://codereview.chromium.org/1936083002
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1035981
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3590
Release Notes, Vendor Advisory x_refsource_confirm
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2992-1
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2016:1190
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201607-07

Scores

CVSS v3 6.5
EPSS 0.0309
EPSS Percentile 86.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (12)
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 15.10
canonical/ubuntu_linux 16.04
debian/debian_linux 8.0
google/chrome < 50.0.2661.102
google/v8 < 5.1.281
opensuse/leap 42.1
opensuse/opensuse 13.2
redhat/enterprise_linux_desktop 6.0
redhat/enterprise_linux_server 6.0
... and 2 more
Published Jun 05, 2016
Tracked Since Feb 18, 2026