CVE-2016-5207 - Vulnerability Details - OpenCVE

In Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android, corruption of the DOM tree could occur during the removal of a full screen element, which allowed a remote attacker to achieve arbitrary code execution via a crafted HTML page.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Google	Chrome
Redhat	Rhel Extras

Configuration 1 [-]

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 6 Supplementary
chromium-browser-0:55.0.2883.75-1.el6	cpe:/a:redhat:rhel_extras:6	RHSA-2016:2919	2016-12-07T00:00:00Z

References

Link	Providers
http://rhn.redhat.com/errata/RHSA-2016-2919.html
http://www.securityfocus.com/bid/94633
https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
https://crbug.com/655904
https://googlechromereleases.blogspot.com/2016/12/stable-channel-update-for-desktop.html
https://nvd.nist.gov/vuln/detail/CVE-2016-5207
https://security.gentoo.org/glsa/201612-11
https://www.cve.org/CVERecord?id=CVE-2016-5207

History

No history.

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2017-01-19T05:43:00

Updated: 2024-08-06T00:53:48.623Z

Reserved: 2016-05-31T00:00:00

Link: CVE-2016-5207

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-01-19T05:59:00.497

Modified: 2024-11-21T02:53:50.487

Link: CVE-2016-5207

Redhat

Severity : Important

Publid Date: 2016-12-01T00:00:00Z

Links: CVE-2016-5207 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android", "vendor": "n/a", "versions": [{"status": "affected", "version": "Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android"}]}], "datePublic": "2016-12-01T00:00:00", "descriptions": [{"lang": "en", "value": "In Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android, corruption of the DOM tree could occur during the removal of a full screen element, which allowed a remote attacker to achieve arbitrary code execution via a crafted HTML page."}], "problemTypes": [{"descriptions": [{"description": "object corruption", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-04T19:57:01", "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome"}, "references": [{"name": "RHSA-2016:2919", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2919.html"}, {"name": "94633", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/94633"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://crbug.com/655904"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html"}, {"name": "GLSA-201612-11", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201612-11"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@google.com", "ID": "CVE-2016-5207", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android", "version": {"version_data": [{"version_value": "Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android, corruption of the DOM tree could occur during the removal of a full screen element, which allowed a remote attacker to achieve arbitrary code execution via a crafted HTML page."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "object corruption"}]}]}, "references": {"reference_data": [{"name": "RHSA-2016:2919", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2016-2919.html"}, {"name": "94633", "refsource": "BID", "url": "http://www.securityfocus.com/bid/94633"}, {"name": "https://crbug.com/655904", "refsource": "CONFIRM", "url": "https://crbug.com/655904"}, {"name": "https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html", "refsource": "CONFIRM", "url": "https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html"}, {"name": "GLSA-201612-11", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201612-11"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T00:53:48.623Z"}, "title": "CVE Program Container", "references": [{"name": "RHSA-2016:2919", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2919.html"}, {"name": "94633", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/94633"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://crbug.com/655904"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html"}, {"name": "GLSA-201612-11", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201612-11"}]}]}, "cveMetadata": {"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "assignerShortName": "Chrome", "cveId": "CVE-2016-5207", "datePublished": "2017-01-19T05:43:00", "dateReserved": "2016-05-31T00:00:00", "dateUpdated": "2024-08-06T00:53:48.623Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "85349E1C-5290-4A05-B79B-142BE5B508B5", "versionEndIncluding": "54.0.2840.99", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android, corruption of the DOM tree could occur during the removal of a full screen element, which allowed a remote attacker to achieve arbitrary code execution via a crafted HTML page."}, {"lang": "es", "value": "En Blink en Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android, la corrupci\u00f3n del \u00e1rbol DOM puede ocurrir durante la eliminaci\u00f3n de un elemento de pantalla completa, lo que permiti\u00f3 a un atacante remoto conseguir ejecuci\u00f3n de c\u00f3digo a trav\u00e9s de una p\u00e1gina HTML manipulada."}], "id": "CVE-2016-5207", "lastModified": "2024-11-21T02:53:50.487", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-01-19T05:59:00.497", "references": [{"source": "chrome-cve-admin@google.com", "url": "http://rhn.redhat.com/errata/RHSA-2016-2919.html"}, {"source": "chrome-cve-admin@google.com", "url": "http://www.securityfocus.com/bid/94633"}, {"source": "chrome-cve-admin@google.com", "url": "https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html"}, {"source": "chrome-cve-admin@google.com", "url": "https://crbug.com/655904"}, {"source": "chrome-cve-admin@google.com", "url": "https://security.gentoo.org/glsa/201612-11"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2016-2919.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/94633"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://crbug.com/655904"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201612-11"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}