NVD Vulnerability Detail

CVE-2016-1665

Summary	The JSGenericLowering class in compiler/js-generic-lowering.cc in Google V8, as used in Google Chrome before 50.0.2661.94, mishandles comparison operators, which allows remote attackers to obtain sensitive information via crafted JavaScript code.
Publication Date	May 15, 2016, 6:59 a.m.
Registration Date	Jan. 26, 2021, 2:07 p.m.
Last Update	Nov. 21, 2024, 11:46 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:opensuse:opensuse:13.1:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_server_supplementary_eus:6.7z:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop_supplementary:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_supplementary:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation_supplementary:6.0:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:a:google:chrome::::::::			50.0.2661.87

Related information, measures and tools

No	URL	refsource	タグ
1	http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_28.html
2	http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_28.html
3	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00002.html
4	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00002.html
5	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00003.html
6	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00003.html
7	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00004.html
8	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00004.html
9	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00048.html
10	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00048.html
11	http://rhn.redhat.com/errata/RHSA-2016-0707.html
12	http://rhn.redhat.com/errata/RHSA-2016-0707.html
13	http://www.debian.org/security/2016/dsa-3564
14	http://www.debian.org/security/2016/dsa-3564
15	http://www.securityfocus.com/bid/89106
16	http://www.securityfocus.com/bid/89106
17	http://www.ubuntu.com/usn/USN-2960-1
18	http://www.ubuntu.com/usn/USN-2960-1
19	https://codereview.chromium.org/1925463003
20	https://codereview.chromium.org/1925463003
21	https://crbug.com/606181
22	https://crbug.com/606181
23	https://security.gentoo.org/glsa/201605-02
24	https://security.gentoo.org/glsa/201605-02

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

Google Chrome で使用される Google V8 の compiler/js-generic-lowering.cc の JSGenericLowering クラスにおける重要な情報を取得される脆弱性

Title	Google Chrome で使用される Google V8 の compiler/js-generic-lowering.cc の JSGenericLowering クラスにおける重要な情報を取得される脆弱性
Summary	Google Chrome で使用される Google V8 の compiler/js-generic-lowering.cc の JSGenericLowering クラスは、比較演算子を誤って処理するため、重要な情報を取得される脆弱性が存在します。
Possible impacts	第三者により、巧妙に細工された JavaScript コードを介して、重要な情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 28, 2016, midnight
Registration Date	May 20, 2016, 4:49 p.m.
Last Update	Aug. 29, 2016, 5:38 p.m.

Affected System

レッドハット

Red Hat Enterprise Linux Desktop Supplementary (v. 6)

Red Hat Enterprise Linux Server Supplementary (v. 6)

Red Hat Enterprise Linux Server Supplementary EUS (v. 6.7.z)

Red Hat Enterprise Linux Workstation Supplementary (v. 6)

Google

Google Chrome 50.0.2661.94 未満

openSUSE project

openSUSE 13.1

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-1665	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1665
National Vulnerability Database (NVD)
2	CVE-2016-1665	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1665

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Chromium Code Reviews
1	Issue 1925463003	https://codereview.chromium.org/1925463003
Google
2	Google Chrome	https://www.google.com/intl/ja/chrome/browser/features.html
3	Stable Channel Update	http://googlechromereleases.blogspot.jp/2016/04/stable-channel-update_28.html
opensuse-security-announce
4	openSUSE-SU-2016:1655	http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00048.html
Red Hat Security Advisory
5	RHSA-2016:0707	http://rhn.redhat.com/errata/RHSA-2016-0707.html

Change Log

No	Changed Details	Date of change
0	[2016年05月20日] 掲載 [2016年08月29日] ベンダ情報：レッドハット (RHSA-2016:0707) を追加ベンダ情報：openSUSE project (openSUSE-SU-2016:1655) を追加影響を受けるシステム：ベンダ情報の追加に伴い内容を更新	Feb. 17, 2018, 10:37 a.m.