NVD

Id
18056  
Name
CVE-2016-1706  
Description
The PPAPI implementation in Google Chrome before 52.0.2743.82 does not validate the origin of IPC messages to the plugin broker process that should have come from the browser process, which allows remote attackers to bypass a sandbox protection mechanism via an unexpected message type, related to broker_process_dispatcher.cc, ppapi_plugin_process_host.cc, ppapi_thread.cc, and render_frame_message_filter.cc.  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2016-07-23  
Modified Date
2016-11-28  
Seq
2016-1706  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
99413 18056 CVE-2016-1706 http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html  View
99414 18056 CVE-2016-1706 openSUSE-SU-2016:1865  View
99415 18056 CVE-2016-1706 openSUSE-SU-2016:1868  View
99416 18056 CVE-2016-1706 openSUSE-SU-2016:1869  View
99417 18056 CVE-2016-1706 openSUSE-SU-2016:1918  View
99418 18056 CVE-2016-1706 RHSA-2016:1485  View
99419 18056 CVE-2016-1706 DSA-3637  View
99420 18056 CVE-2016-1706 USN-3041-1  View
99421 18056 CVE-2016-1706 https://codereview.chromium.org/2069853002/  View
99422 18056 CVE-2016-1706 https://crbug.com/610600  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
3224 JVNDB-2016-003997 Google Chrome の PPAPI の実装におけるサンドボックス保護メカニズムを回避される脆弱性 Google Chrome の PPAPI の実装は、ブラウザのプロセスから発生しているはずのプラグインブローカのプロセスに対する IPC メッセージの生成元 (origin) を検証しないため、サンドボックス保護メカニズムを回避される脆弱性が存在します。 CVE-2016-1706 88212 CVE-2016-1706 18056 9.3 9.6 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-003997.html 2016-07-20 2016-07-28 View