CVE-2016-1624 describes an integer underflow vulnerability in the Brotli compression library's ProcessCommandsInternal function, affecting Google Chrome versions prior to 48.0.2564.109 and various Debian and OpenSUSE distributions. This flaw allows remote attackers to trigger a denial of service via a buffer overflow, with potential for other unspecified impacts, by providing specially crafted brotli-compressed data. The vulnerability is rated with a CVSS score of 8.8 (High), indicating a network-based attack with low complexity, requiring user interaction, and leading to high impacts on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage, suggesting low current threat activity.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
13.1CPE matchmatch criteria | cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* | ||
<= 48.0.2564.103CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.