CVE-2016-9642

JavaScriptCore in WebKit allows attackers to cause a denial of service (out-of-bounds heap read)...

5.5 MediumFix available

CVE-2016-9642 is a medium vulnerability (CVSS 5.5) in Webkit, published February 3, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.27%, the 69th percentile. Fixed in webkit2gtk 2.16.1-0ubuntu0.16.04.1.

JavaScriptCore in WebKit allows attackers to cause a denial of service (out-of-bounds heap read) via a crafted Javascript file.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.27%Up 0.3 points since Feb 4, 2022

What each source reports

NVD Score used 5.5

JavaScriptCore in WebKit allows attackers to cause a denial of service (out-of-bounds heap read) via a crafted Javascript file.

Record: CVE-2016-9642
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-125
Updated: 2026-11-02

CVE List No score

JavaScriptCore in WebKit allows attackers to cause a denial of service (out-of-bounds heap read) via a crafted Javascript file.

Record: CVE-2016-9642
Updated: 2026-11-02

EUVDEUVD-2016-10443 No score

JavaScriptCore in WebKit allows attackers to cause a denial of service (out-of-bounds heap read) via a crafted Javascript file.

Record: EUVD-2016-10443
Updated: 2026-11-03

GitHub AdvisoriesGHSA-v9jj-hfg8-mx43 5.5

JavaScriptCore in WebKit allows attackers to cause a denial of service (out-of-bounds heap read)...

JavaScriptCore in WebKit allows attackers to cause a denial of service (out-of-bounds heap read) via a crafted Javascript file.

Record: GHSA-v9jj-hfg8-mx43
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-9642 5.5

JavaScriptCore in WebKit allows attackers to cause a denial of service (out-of-bounds heap read) via a crafted Javascript file.

Record: UBUNTU-CVE-2016-9642
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUSN-3257-1 No score

webkit2gtk vulnerabilities

A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

Record: USN-3257-1
Updated: 2026-11-02

Affected products

webkit

Affected packages

Affected packages
Package	Affected	Fixed
`webkit2gtk` Ubuntu:16.04:LTS	before 2.16.1-0ubuntu0.16.04.1, plus listed versions 2.8.5+dfsg1-32.10.3+dfsg1-12.10.4+dfsg1-12.10.5-12.10.6-1 Show 7 moreShow less 2.10.6-1ubuntu12.10.8-1ubuntu12.10.9-1ubuntu12.12.5-0ubuntu0.16.04.12.14.2-0ubuntu0.16.04.12.14.3-0ubuntu0.16.04.12.14.5-0ubuntu0.16.04.1	2.16.1-0ubuntu0.16.04.1
`qtwebkit-opensource-src` Ubuntu:16.04:LTS	All versions, plus listed versions 5.4.2+dfsg-1ubuntu2.15.5.1+dfsg-2ubuntu1	None known
`qtwebkit-source` Ubuntu:16.04:LTS	All versions, plus listed versions 2.3.2-0ubuntu102.3.2-0ubuntu11	None known
`webkitgtk` Ubuntu:16.04:LTS	All versions, plus listed versions 2.4.9-2ubuntu22.4.10-0ubuntu12.4.11-0ubuntu0.1	None known
`qtwebkit-opensource-src` Ubuntu:18.04:LTS	All versions, plus listed versions 5.9.1+dfsg-5ubuntu15.9.1+dfsg-5ubuntu35.212.0~alpha2-5build25.212.0~alpha2-5build45.212.0~alpha2-75.212.0~alpha2-7build25.212.0~alpha2-7ubuntu1	None known
`qtwebkit-source` Ubuntu:18.04:LTS	All versions, plus listed versions 2.3.2-0ubuntu13	None known
`webkitgtk` Ubuntu:18.04:LTS	All versions, plus listed versions 2.4.11-32.4.11-3ubuntu22.4.11-3ubuntu3	None known
`qtwebkit-opensource-src` Ubuntu:20.04:LTS	All versions, plus listed versions 5.212.0~alpha3-35.212.0~alpha3-55.212.0~alpha3-65.212.0~alpha3-75.212.0~alpha4-15.212.0~alpha4-1ubuntu15.212.0~alpha4-1ubuntu25.212.0~alpha4-1ubuntu2.1	None known
`qtwebkit-opensource-src` Ubuntu:22.04:LTS	All versions, plus listed versions 5.212.0~alpha4-125.212.0~alpha4-135.212.0~alpha4-145.212.0~alpha4-14build15.212.0~alpha4-14ubuntu25.212.0~alpha4-15ubuntu1	None known
`qtwebkit-opensource-src` Ubuntu:24.04:LTS	All versions, plus listed versions 5.212.0~alpha4-335.212.0~alpha4-33build15.212.0~alpha4-345.212.0~alpha4-34ubuntu35.212.0~alpha4-34ubuntu45.212.0~alpha4-36	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 37 moreShow less