NVD

Id
17986  
Name
CVE-2016-1636  
Description
The PendingScript::notifyFinished function in WebKit/Source/core/dom/PendingScript.cpp in Google Chrome before 49.0.2623.75 relies on memory-cache information about integrity-check occurrences instead of integrity-check successes, which allows remote attackers to bypass the Subresource Integrity (aka SRI) protection mechanism by triggering two loads of the same resource.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-03-05  
Modified Date
2016-12-02  
Seq
2016-1636  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
98600 17986 CVE-2016-1636 http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html  View
98601 17986 CVE-2016-1636 openSUSE-SU-2016:0664  View
98602 17986 CVE-2016-1636 SUSE-SU-2016:0665  View
98603 17986 CVE-2016-1636 openSUSE-SU-2016:0684  View
98604 17986 CVE-2016-1636 openSUSE-SU-2016:0729  View
98605 17986 CVE-2016-1636 DSA-3507  View
98606 17986 CVE-2016-1636 84008  View
98607 17986 CVE-2016-1636 1035185  View
98608 17986 CVE-2016-1636 USN-2920-1  View
98609 17986 CVE-2016-1636 https://code.google.com/p/chromium/issues/detail?id=584155  View
98610 17986 CVE-2016-1636 https://codereview.chromium.org/1713093002  View
98611 17986 CVE-2016-1636 GLSA-201603-09  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
851 JVNDB-2016-001624 Google Chrome の WebKit/Source/core/dom/PendingScript.cpp における Subresource Integrity 保護メカニズムを回避される脆弱性 Google Chrome の WebKit/Source/core/dom/PendingScript.cpp の PendingScript::notifyFinished 関数は、インテグリティチェックの成功ではなくインテグリティチェックの発生に関するメモリキャッシュ情報に依存するため、Subresource Integrity (別名 SRI) 保護メカニズムを回避される脆弱性が存在します。 CVE-2016-1636 88142 CVE-2016-1636 17986 7.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-001624.html 2016-03-02 2016-03-08 View