Security Bulletin: Buffer overflow in V8

Summary

Under certain conditions, V8 may improperly expand memory allocations in the Zone::New function. This could potentially be used to cause a Denial of Service via buffer overflow or as a trigger for a remote code execution.

Vulnerability Details

CVEID: CVE-2016-1669**
DESCRIPTION:** Google Chrome is vulnerable to a buffer overflow, caused by an error in V8. By persuading a victim to visit a specially-crafted Web site, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 6.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/113145 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)

Affected Products and Versions

IBM Rational Application Developer for WebSphere Software v9.1 and v9.5

Remediation/Fixes

Rational Application Developer

| 9.1.x and 9.5.x| PI65665|

• Apply IBM SDK for Node.js Version 1.1 release updated equivalent to the Joyent Node.js API version 0.10.46 to the Cordova platform in the product.

Installation instructions for applying the update to the Cordova platform in the product can be found here:

Upgrading the IBM SDK for Node.js used by Cordova
—|—|—|—