Arbitrary code execution in Google Chrome - CVE-2016-5178

Vulnerability identifier: #VU808

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-5178

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to cause arbitrary code execution on the target user's system.
The weakness exists due to insufficient input validation. By sending a specially crafted content and tricking the victim to upload it attackers can trigger the arbitrary code to be executed.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Google Chrome
Arch Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Fedora
chromium

Update to version 53.0.2785.143.

Google Chrome - update to 53.0.2785.143
chromium - addressed in versions 53.0.2785.143-1.fc24, 53.0.2785.143-1.fc25

• https://googlechromereleases.blogspot.com/2016/09/stable-channel-update-for-desktop_29.html

• Arch Linux update for chromium
• Red Hat update for chromium-browser
• Fedora 24 update for chromium
• Fedora 25 update for chromium