CVE-2016-5220 - Vulnerability Details - OpenCVE

PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to read local files via a crafted PDF file.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Google	Chrome
Redhat	Rhel Extras

Configuration 1 [-]

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 6 Supplementary
chromium-browser-0:55.0.2883.75-1.el6	cpe:/a:redhat:rhel_extras:6	RHSA-2016:2919	2016-12-07T00:00:00Z

References

Link	Providers
http://rhn.redhat.com/errata/RHSA-2016-2919.html
http://www.securityfocus.com/bid/94633
https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
https://crbug.com/654279
https://googlechromereleases.blogspot.com/2016/12/stable-channel-update-for-desktop.html
https://nvd.nist.gov/vuln/detail/CVE-2016-5220
https://security.gentoo.org/glsa/201612-11
https://www.cve.org/CVERecord?id=CVE-2016-5220

History

No history.

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2017-01-19T05:43:00

Updated: 2024-08-06T00:53:48.859Z

Reserved: 2016-05-31T00:00:00

Link: CVE-2016-5220

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-01-19T05:59:00.933

Modified: 2024-11-21T02:53:51.990

Link: CVE-2016-5220

Redhat

Severity : Moderate

Publid Date: 2016-12-01T00:00:00Z

Links: CVE-2016-5220 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android", "vendor": "n/a", "versions": [{"status": "affected", "version": "Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android"}]}], "datePublic": "2016-12-01T00:00:00", "descriptions": [{"lang": "en", "value": "PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to read local files via a crafted PDF file."}], "problemTypes": [{"descriptions": [{"description": "insufficient policy enforcement", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-04T19:57:01", "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome"}, "references": [{"name": "RHSA-2016:2919", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2919.html"}, {"name": "94633", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/94633"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://crbug.com/654279"}, {"name": "GLSA-201612-11", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201612-11"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@google.com", "ID": "CVE-2016-5220", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android", "version": {"version_data": [{"version_value": "Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to read local files via a crafted PDF file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "insufficient policy enforcement"}]}]}, "references": {"reference_data": [{"name": "RHSA-2016:2919", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2016-2919.html"}, {"name": "94633", "refsource": "BID", "url": "http://www.securityfocus.com/bid/94633"}, {"name": "https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html", "refsource": "CONFIRM", "url": "https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html"}, {"name": "https://crbug.com/654279", "refsource": "CONFIRM", "url": "https://crbug.com/654279"}, {"name": "GLSA-201612-11", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201612-11"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T00:53:48.859Z"}, "title": "CVE Program Container", "references": [{"name": "RHSA-2016:2919", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2919.html"}, {"name": "94633", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/94633"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://crbug.com/654279"}, {"name": "GLSA-201612-11", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201612-11"}]}]}, "cveMetadata": {"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "assignerShortName": "Chrome", "cveId": "CVE-2016-5220", "datePublished": "2017-01-19T05:43:00", "dateReserved": "2016-05-31T00:00:00", "dateUpdated": "2024-08-06T00:53:48.859Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "85349E1C-5290-4A05-B79B-142BE5B508B5", "versionEndIncluding": "54.0.2840.99", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to read local files via a crafted PDF file."}, {"lang": "es", "value": "PDFium en Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android maneja incorrectamente la navegaci\u00f3n en PDFs, lo que permiti\u00f3 a un atacante remoto leer archivos locales a trav\u00e9s de un archivo PDF manipulado."}], "id": "CVE-2016-5220", "lastModified": "2024-11-21T02:53:51.990", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-01-19T05:59:00.933", "references": [{"source": "chrome-cve-admin@google.com", "url": "http://rhn.redhat.com/errata/RHSA-2016-2919.html"}, {"source": "chrome-cve-admin@google.com", "url": "http://www.securityfocus.com/bid/94633"}, {"source": "chrome-cve-admin@google.com", "url": "https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html"}, {"source": "chrome-cve-admin@google.com", "url": "https://crbug.com/654279"}, {"source": "chrome-cve-admin@google.com", "url": "https://security.gentoo.org/glsa/201612-11"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2016-2919.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/94633"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://crbug.com/654279"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201612-11"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}