Quick answers
- Is CVE-2016-5215 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2016-5215 being exploited in the wild.
- How severe is CVE-2016-5215?
- Medium severity, with a CVSS score of 6.3, published 19 January 2017.
- Which products and versions are affected?
- Google Chromium Prior to 55.0.2883.75.
- Is there a fix for CVE-2016-5215?
- A patch was published on 2016-12-01: Chrome Stable Channel Update for Desktop released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2016-5215 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2016-5215?
- Check whether you run Google Chrome or Google Chromium at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A use-after-free (UAF) vulnerability exists in the WebAudio implementation of Google Chrome and Chromium. The flaw is triggered when the browser incorrectly manages memory objects during audio processing, allowing a remote attacker to induce an out-of-bounds (OOB) memory read. To exploit this, an attacker must entice a user to visit a specially crafted HTML page. Successful exploitation can result in the disclosure of sensitive information from the browser's memory space or a denial-of-service (crash) condition. The issue was resolved in Chrome version 55.0.2883.75 for desktop platforms and 55.0.2883.84 for Android.
Affected products
- Google Chrome Prior to 55.0.2883.75 (Desktop); Prior to 55.0.2883.84 (Android)
- Google Chromium Prior to 55.0.2883.75
Timeline
- 2016-12-01: patched: Chrome Stable Channel Update for Desktop released
- 2016-12-05: advisory: Gentoo Linux security advisory published
- 2016-12-07: advisory: Red Hat security advisory published
- 2017-01-19: disclosed: NVD publication date