CVE-2016-5131

CVE-2016-5131 is a use-after-free in libxml2 up to version 2.9.4 (as used in Chrome before 52.0.2743.82) triggered by XPointer range-to, leading to possible denial of service and potentially other impact. Connected advisories reaffirms libxml2 as the vulnerable component and references several ve...

CVE-2016-2178

OpenSSL CVE-2016-2178: The dsa_sign_setup path in OpenSSL up to version 1.0.2h can process DSA signing in a non-constant-time way, enabling a local attacker to recover a private DSA key via a timing side-channel. Several advisories note this alongside other OpenSSL fixes and generally recommend u...

CVE-2016-1960

CVE-2016-1960 is a vulnerability in Mozilla Firefox’s HTML5 parser (nsHtml5TreeBuilder) involving an integer underflow that enables a use-after-free scenario when parsing end tags in a foreign fragment context (SVG). Affects Firefox before 45.0 and Firefox ESR 38.x before 38.7; exploitation can l...

CVE-2016-2796

CVE-2016-2796 describes a heap-based buffer overflow in the Graphite 2 font library (graphite2::vm::Machine::Code::Code) prior to 1.3.6. The vulnerability affected Graphite 2 as used by Mozilla Firefox (before 45.0) and Firefox ESR 38.x (before 38.7), potentially enabling a remote attacker to cau...

CVE-2016-1977

Summary: CVE-2016-1977 and related Graphite 2 vulnerabilities affect Graphite font rendering (library graphite2) used by Mozilla Firefox/Thunderbird. The issues stem from memory safety bugs in Graphite 2 (version 1.3.5 and earlier) that could allow remote code execution or crashes when processing...

CVE-2016-2800

The Graphite 2 font rendering library is affected by CVE-2016-2800 and CVE-2016-2792. In Graphite 2, the vulnerability resides in graphite2::Slot::getAttr (Slot.cpp) and can be triggered when processing crafted Graphite fonts, as used by Mozilla Firefox prior to 45.0 and Firefox ESR 38.x prior to...

CVE-2016-1974

The CVE-2016-1974 issue affects Mozilla Firefox and Firefox ESR, where nsScannerString::AppendUnicodeTo can fail to verify memory allocation success, enabling a remote attacker to crash the browser or potentially execute arbitrary code via crafted Unicode data in HTML/XML/SVG. Affected versions a...

CVE-2016-2792

CVE-2016-2792 affects Graphite2 (graphite2) in Graphite font rendering used by Firefox

CVE-2016-1961

CVE-2016-1961 is a use-after-free in Mozilla Firefox’s HTMLDocument::SetBody (dom/html/nsHTMLDocument.cpp) that could crash the browser and allow remote code execution. Affected products are Firefox before 45.0 and Firefox ESR 38.x before 38.7. The vulnerability stems from mishandling of the root...

CVE-2016-1964

CVE-2016-1964 is a use-after-free in Mozilla Firefox’s AtomicBaseIncDec during XML transformation handling. Affects Firefox before 45.0 and Firefox ESR 38.x before 38.7; impact includes remote code execution or heap-based denial of service when processing certain XML transformations. The issue ca...

CVE-2016-2797

Graphite 2 before 1.3.6 is affected by CVE-2016-2797 via the TtfUtil::CmapSubtable12Lookup path. The vulnerability exists when Graphite is used by Firefox before 45.0 and Firefox ESR 38.x before 38.7, allowing a crafted Graphite smart font to cause a denial-of-service (buffer over-read) or simila...

CVE-2016-1697

CVE-2016-1697 affects Google Chrome (Blink/WebKit) prior to 51.0.2704.79. The FrameLoader::startLoad path in FrameLoader.cpp does not prevent frame navigations during DocumentLoader detach, enabling a remote attacker to bypass the Same Origin Policy via crafted JavaScript. A patch was released in...

CVE-2016-1683

CVE-2016-1683 affects libxslt prior to 1.1.29, as used in Google Chrome before 51.0.2704.63. The issue arises from numbers.c in libxslt, where namespace nodes are mishandled, enabling a remote attacker to trigger out-of-bounds heap memory access and cause a denial of service (with potential unspe...

CVE-2016-2807

CVE-2016-2807 is a set of memory-safety issues in Mozilla Firefox’s browser engine affecting Firefox, ESR 38.x and ESR 45.x branches. Connected advisories indicate these flaws could allow memory corruption and a potential arbitrary-code execution or DoS. Remediation across sources centers on upgr...

CVE-2016-2798

The CVE-2016-2798 issue affects the Graphite2 font library (Graphite 2) prior to version 1.3.6 used by Mozilla Firefox/Firefox ESR. The vulnerability arises in Graphite2::GlyphCache::Loader::Loader, allowing a remote attacker to trigger a denial of service via a crafted Graphite font, with potent...

CVE-2016-2793

CVE-2016-2793 affects the Graphite 2 font library (CachedCmap.cpp) up to version 1.3.5 used by Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7. A crafted Graphite font can trigger a buffer over-read, potentially causing a denial of service or other impact. Remediation, where availabl...

CVE-2016-2795

Graphite 2 vulnerability CVE-2016-2795 affects the Graphite font engine library. The function graphite2::FileFace::get_table_fn in Graphite 2 before 1.3.6 does not initialize memory for an unspecified data structure, enabling a remote attacker to cause denial of service (and possibly other impact...

CVE-2016-2799

CVE-2016-2799 is a heap-based buffer overflow in graphite2::Slot::setAttr in Graphite2 up to 1.3.6, impacting Firefox <45.0 and Firefox ESR =1.3.7) to remediate. Monitor vendor advisories for exact fixed versions per distribution.

CVE-2016-2790

The CVE-2016-2790 issue is in Graphite 2 prior to 1.3.6 (graphite2) used by Firefox/Firefox ESR. The root cause is uninitialized memory in Graphite’s TtfUtil::GetTableInfo, enabling a remote attacker to cause a denial of service or potentially other impact via a crafted Graphite font. Impact is t...

CVE-2016-1676

CVE-2016-1676 affects Google Chrome/Chromium before 51.0.2704.63. The issue is a cross-origin bypass in extension bindings (bindings.js) caused by improper prototype handling in the extensions framework, enabling remote bypass of Same Origin Policy via unspecified vectors. Debian security advisor...

CVE-2016-2801

CVE-2016-2797 describes a vulnerability in Graphite2 where the TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6 can be triggered by a crafted Graphite font, used by Firefox before 45.0 and ESR before 38.7, leading to a denial of service via a buffer over-read. The issue is due to...

CVE-2016-2802

Summary: CVE-2016-2802 affects Graphite 2 before 1.3.6, used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7. The flaw resides in graphite2::TtfUtil::CmapSubtable4NextCodepoint and can be exploited to trigger a crash via a crafted Graphite font (buffer over-read), causing a denial...

CVE-2016-1688

CVE-2016-1688 is an out-of-bounds read in the V8 JavaScript library used by Google Chrome/Chromium prior to 51.0.2704.63. The root cause involves mishandling external string sizes, enabling a remote attacker to trigger a denial of service via crafted JavaScript. Remediation: upgrade to Chrome/Chr...

CVE-2016-2791

Summary: CVE-2016-2791 affects the Graphite 2 font library (graphite2) shipped with Graphite-based builds and Mozilla Firefox. The issue is in graphite2::GlyphCache::glyph, where a crafted Graphite font can trigger a buffer over-read, potentially allowing a denial of service and other unspecified...

CVE-2016-1691

CVE-2016-1691 affects the Skia library used by Google Chrome prior to 51.0.2704.63. The issue arises from mishandling of coincidence runs in SkOpCoincidence.cpp and SkPathOpsCommon.cpp, enabling a remote attacker to trigger a heap-based buffer overflow and cause a denial of service (with possible...

CVE-2016-2794

The CVE-2016-2794 entry concerns Graphite 2 prior to version 1.3.6. The vulnerable function is graphite2::TtfUtil::CmapSubtable12NextCodepoint, used by Mozilla Firefox (before 45.0) and Firefox ESR 38.x (before 38.7). A crafted Graphite font can cause a buffer over-read, leading to a denial of se...

CVE-2016-1672

CVE-2016-1672 affects Google Chrome up to version 51.0.2704.63, where the ModuleSystem::RequireForJsInner function in extension bindings mishandles properties, enabling remote cross-origin bypass via unspecified vectors. Public advisories and vendor fixes (e.g., Chromium 51.0.2704.63) address the...

CVE-2016-1677

CVE-2016-1677 refers to a type confusion in the V8 JavaScript engine used by Google Chrome/Chromium prior to version 51.0.2704.63. The flaw could allow a remote attacker to obtain sensitive information by calling decodeURI, via the affected V8 bindings, as part of the Chromium/Chrome stack. The c...

CVE-2016-2806

CVE-2016-2806 affects Mozilla Firefox before 46.0 and Firefox ESR 45.x before 45.1. The issue is described as memory safety vulnerabilities in the browser engine that could lead to memory corruption, a denial of service, or possibly arbitrary code execution via unknown vectors. The connected sour...

CVE-2016-1698

In CVE-2016-1698, Google Chrome’s extensions/renderer/resources/binding.js createCustomType did not validate module types, causing an information disclosure via a poisoned definition. Affected is Chrome before 51.0.2704.79; the issue could allow loading arbitrary modules or exposing sensitive dat...

CVE-2016-1659

CVE-2016-1659 is part of the Chromium/Google Chrome 50.0.2661.75 update (20 security fixes total). The Chrome release notes attribute CVE-2016-1659 to “various fixes from internal audits, fuzzing and other initiatives.” The connected documents indicate this CVE is addressed alongside other issues...

CVE-2016-1674

CVE-2016-1674 is a cross‑origin bypass vulnerability in Chrome/Chromium extensions bindings. The issue is described in the official Chrome security release notes for Chrome 51 (51.0.2704.63) and is listed among multiple CVEs fixed in that build. Debian security advisories also note fixes for chro...

CVE-2016-1681

The CVE-2016-1681 issue is a heap-based buffer overflow in the opj_j2k_read_SPCod_SPCoc function (j2k.c) in OpenJPEG, as used by PDFium in Google Chrome. Exploitation could allow a remote attacker to cause a denial of service or potentially other impact via a crafted PDF document. Connected advis...

CVE-2016-1690

CVE-2016-1690 affects Google Chrome Autofill: the interaction between field updates and JavaScript that triggers a frame deletion allows remote attackers to cause a use-after-free DoS (and possibly other impact) via a crafted website. Affected versions are prior to 51.0.2704.63 (and related advis...

CVE-2016-1696

CVE-2016-1696 affects Google Chrome prior to 51.0.2704.79, where the extensions subsystem did not properly restrict bindings access, enabling a cross-origin bypass of the Same Origin Policy via unspecified vectors. Multiple connected sources (Chromium security advisories and Debian/arch updates) ...

CVE-2016-1675

CVE-2016-1675 affects Google Chrome/Chromium up to 51.0.2704.63. It is a Same Origin Policy bypass in Blink/WebKit caused by mishandling of Document reattachment during destruction, related to FrameLoader.cpp and LocalFrame.cpp. The Chrome/Chromium 51 stable update (51.0.2704.63) fixes this and r...

CVE-2016-1695

Summary: CVE-2016-1695 is associated with multiple issues in the Chromium/Google Chrome stack that were addressed in Chromium/Chrome upgrades to version 51.0.2704.63. Debian security advisories (DSA-3590-1 and related entries) specify that chromium-browser was updated to fix this and related CVEs...

CVE-2016-1679

CVE-2016-1679 affects Google Chrome prior to 51.0.2704.63, specifically the ToV8Value function in content/child/v8_value_converter_impl.cc used by the V8 bindings. The issue improperly restricts use of getters and setters, enabling remote attackers to trigger a denial-of-service via a use-after-f...

CVE-2016-1680

CVE-2016-1680 is a use-after-free in Skia (SkFontHost_FreeType.cpp) used by Google Chrome prior to 51.0.2704.63. The vulnerability could cause a denial of service via heap memory corruption. Chrome 51.0.2704.63 (and later) includes fixes for this issue. The available documents provide the vulnera...

CVE-2016-1689

CVE-2016-1689 refers to a heap-based buffer overflow in Google Chrome before 51.0.2704.63, specifically in content/renderer/media/canvas_capture_handler.cc. The vulnerability could allow a remote attacker to cause a denial of service or other impact via a crafted web site. The public records in t...

CVE-2016-1700

CVE-2016-1700 concerns Google Chrome/Chromium up to version 51.0.2704.79, where extensions/renderer/runtime_custom_bindings.cc does not account for side effects when creating an array of extension views. This can lead to a use-after-free in extensions, with the primary consequence described as a ...

CVE-2016-1682

The CVE-2016-1682 entry covers a CSP bypass in ServiceWorker registration via Blink/WebKit used by Google Chrome prior to 51.0.2704.63. Affected component is ServiceWorkerContainer::registerServiceWorkerImpl in Blink; root cause is CSP protection bypass during ServiceWorker registration. Impact i...

CVE-2016-1685

CVE-2016-1685 affects PDFium (as used in Google Chrome). The vulnerability is an out-of-bounds read in pdfium/fxge/ge/fx_ge_text.cpp due to miscalculated index values, enabling remote attackers to trigger a denial of service via crafted PDF documents. Public advisories/entries (e.g., Debian/Chrom...

CVE-2016-1699

CVE-2016-1699 affects WebKit/Blink DevTools front_end/devtools.js in Google Chrome prior to 51.0.2704.79. The vulnerability is a parameter sanitization failure in DevTools that could allow a remote attacker to bypass access restrictions by using a crafted URL (remoteFrontendUrl not properly valid...

CVE-2016-1651

CVE-2016-1651 corresponds to an out-of-bounds read in the Pdfium JPEG2000 decoding path used by Chrome/Chromium (fxcodec/codec/fx_codec_jpx_opj.cpp) due to incorrect sycc420_to_rgb and sycc422_to_rgb implementations. This can allow a remote attacker to read sensitive process memory or cause a den...

CVE-2016-1653

CVE-2016-1653 is an out-of-bounds write in Google V8 used by Chrome up to version 50.0.2661.75. The issue, tied to compiler/pipeline.cc and compiler/simplified-lowering.cc, could cause a denial of service and possibly other impact via crafted JavaScript. Affected software includes Google Chrome/C...

CVE-2016-1692

CVE-2016-1692 concerns WebKit/Blink: StyleSheetContents.cpp in Blink, used by Google Chrome prior to 51.0.2704.63, allows a ServiceWorker to cause cross-origin loading of CSS stylesheets even when the stylesheet has an incorrect MIME type. This enables bypassing the Same Origin Policy via a craft...

CVE-2016-1703

CVE-2016-1703 refers to multiple unspecified vulnerabilities in Google Chrome/Chromium up to version 51.0.2704.79, which could allow a remote attacker to cause a denial of service or potentially other impact via unknown vectors. The Mageia advisory explicitly ties CVE-2016-1703 to Chromium 51.0.2...

CVE-2016-1652

CVE-2016-1652 is a Chrome/Chromium vulnerability: a Cross-site scripting (UXSS) in the Extension bindings via ModuleSystem::RequireForJsInner in extensions/renderer/module_system.cc. The issue allows remote attackers to inject arbitrary web script or HTML through a crafted website. Affected produ...

CVE-2016-5325

CVE-2016-5325 is a CRLF injection flaw in Node.js’s ServerResponse#writeHead(), allowing a remote attacker to inject arbitrary HTTP headers via the reason argument. Affected are Node.js versions: 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0. Impact is HTTP ...