CVE catalog

CVE-2016-1624

brotli: CVE-2016-1624

Severity: High · CVSS 8.8CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: Feb 9, 2016, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.35% · Oct 25, 2026

Integer underflow in the ProcessCommandsInternal function in dec/decode.c in Brotli, as used in Google Chrome before 48.0.2564.109, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted data with brotli compression.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	brotli	sid	`1.2.0-4.1`	fixed
Debian	brotli	forky	`1.2.0-4`	fixed
Debian	brotli	trixie	`1.1.0-2`	fixed
Debian	brotli	trixie-security	`1.1.0-2+deb13u1`	fixed
Debian	brotli	bookworm	`1.0.9-2`	fixed
Debian	brotli	bookworm-security	`1.0.9-2+deb12u1`	fixed
Ubuntu	oxide-qt	14.04	`1.0.0~bzr437-0ubuntu1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.0.0~bzr452-0ubuntu1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.0.0~bzr475-0ubuntu1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.0.0~bzr490-0ubuntu1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.0.0~bzr501-0ubuntu1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.0.0~bzr501-0ubuntu2`	vulnerable
Ubuntu	oxide-qt	14.04	`1.0.4-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.0.5-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.1.2-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.2.5-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.3.4-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.4.2-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.4.3-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.5.5-0ubuntu0.14.04.3`	vulnerable
Ubuntu	oxide-qt	14.04	`1.5.6-0ubuntu0.14.04.2`	vulnerable
Ubuntu	oxide-qt	14.04	`1.6.5-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.6.6-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.7.8-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.7.9-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.8.4-0ubuntu0.14.04.2`	vulnerable
Ubuntu	oxide-qt	14.04	`1.9.1-0ubuntu0.14.04.2`	vulnerable
Ubuntu	oxide-qt	14.04	`1.9.5-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.10.3-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.11.3-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.11.4-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.12.5-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.12.6-0ubuntu0.14.04.1`	fixed
Ubuntu	chromium-browser	14.04	`29.0.1547.65-0ubuntu2`	vulnerable
Ubuntu	chromium-browser	14.04	`31.0.1650.63-0ubuntu1~20131204.1`	vulnerable
Ubuntu	chromium-browser	14.04	`32.0.1700.107-0ubuntu1~20140204.977.1`	vulnerable
Ubuntu	chromium-browser	14.04	`33.0.1750.152-0ubuntu1~pkg995.1`	vulnerable
Ubuntu	chromium-browser	14.04	`34.0.1847.116-0ubuntu2`	vulnerable
Ubuntu	chromium-browser	14.04	`36.0.1985.125-0ubuntu1.14.04.0~pkg1029`	vulnerable
Ubuntu	chromium-browser	14.04	`37.0.2062.94-0ubuntu0.14.04.1~pkg1042`	vulnerable
Ubuntu	chromium-browser	14.04	`37.0.2062.120-0ubuntu0.14.04.1~pkg1049`	vulnerable
Ubuntu	chromium-browser	14.04	`38.0.2125.111-0ubuntu0.14.04.1.1061`	vulnerable
Ubuntu	chromium-browser	14.04	`39.0.2171.65-0ubuntu0.14.04.1.1064`	vulnerable
Ubuntu	chromium-browser	14.04	`40.0.2214.94-0ubuntu0.14.04.1.1068`	vulnerable
Ubuntu	chromium-browser	14.04	`40.0.2214.111-0ubuntu0.14.04.1.1069`	vulnerable
Ubuntu	chromium-browser	14.04	`41.0.2272.76-0ubuntu0.14.04.1.1076`	vulnerable
Ubuntu	chromium-browser	14.04	`43.0.2357.81-0ubuntu0.14.04.1.1089`	vulnerable
Ubuntu	chromium-browser	14.04	`43.0.2357.130-0ubuntu0.14.04.1.1092`	vulnerable
Ubuntu	chromium-browser	14.04	`44.0.2403.89-0ubuntu0.14.04.1.1095`	vulnerable
Ubuntu	chromium-browser	14.04	`45.0.2454.85-0ubuntu0.14.04.1.1097`	vulnerable
Ubuntu	chromium-browser	14.04	`45.0.2454.101-0ubuntu0.14.04.1.1099`	vulnerable
Ubuntu	chromium-browser	14.04	`47.0.2526.73-0ubuntu0.14.04.1.1106`	vulnerable
Ubuntu	chromium-browser	14.04	`47.0.2526.106-0ubuntu0.14.04.1.1107`	vulnerable
Ubuntu	chromium-browser	14.04	`48.0.2564.82-0ubuntu0.14.04.1.1108`	vulnerable
Ubuntu	chromium-browser	14.04	`48.0.2564.116-0ubuntu0.14.04.1.1111`	fixed
Ubuntu	oxide-qt	14.04	`1.0.0~bzr437-0ubuntu1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.0.0~bzr452-0ubuntu1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.0.0~bzr475-0ubuntu1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.0.0~bzr490-0ubuntu1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.0.0~bzr501-0ubuntu1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.0.0~bzr501-0ubuntu2`	vulnerable
Ubuntu	oxide-qt	14.04	`1.0.4-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.0.5-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.1.2-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.2.5-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.3.4-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.4.2-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.4.3-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.5.5-0ubuntu0.14.04.3`	vulnerable
Ubuntu	oxide-qt	14.04	`1.5.6-0ubuntu0.14.04.2`	vulnerable
Ubuntu	oxide-qt	14.04	`1.6.5-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.6.6-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.7.8-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.7.9-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.8.4-0ubuntu0.14.04.2`	vulnerable
Ubuntu	oxide-qt	14.04	`1.9.1-0ubuntu0.14.04.2`	vulnerable
Ubuntu	oxide-qt	14.04	`1.9.5-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.10.3-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.11.3-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.11.4-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.12.5-0ubuntu0.14.04.1`	vulnerable
Ubuntu	oxide-qt	14.04	`1.12.6-0ubuntu0.14.04.1`	fixed
Ubuntu	brotli	16.04	`0.2.0+dfsg-1`	vulnerable
Ubuntu	brotli	16.04	`0.3.0+dfsg-1`	vulnerable
Ubuntu	brotli	16.04	`0.3.0+dfsg-2`	vulnerable
Ubuntu	brotli	16.04	`0.3.0+dfsg-2ubuntu1`	fixed
Ubuntu	chromium-browser	16.04	`45.0.2454.101-0ubuntu1.1201`	vulnerable
Ubuntu	chromium-browser	16.04	`47.0.2526.73-0ubuntu1.1218`	vulnerable
Ubuntu	chromium-browser	16.04	`47.0.2526.106-0ubuntu1.1221`	vulnerable
Ubuntu	chromium-browser	16.04	`48.0.2564.82-0ubuntu1.1222`	vulnerable
Ubuntu	chromium-browser	16.04	`48.0.2564.116-0ubuntu1.1229`	fixed
Ubuntu	oxide-qt	16.04	`1.9.5-0ubuntu1`	vulnerable
Ubuntu	oxide-qt	16.04	`1.10.3-0ubuntu0.15.10.1`	vulnerable
Ubuntu	oxide-qt	16.04	`1.10.3-0ubuntu0.15.10.2`	vulnerable
Ubuntu	oxide-qt	16.04	`1.11.3-0ubuntu3`	vulnerable
Ubuntu	oxide-qt	16.04	`1.11.4-0ubuntu1`	vulnerable
Ubuntu	oxide-qt	16.04	`1.11.5-0ubuntu1`	vulnerable
Ubuntu	oxide-qt	16.04	`1.12.5-0ubuntu1`	vulnerable
Ubuntu	oxide-qt	16.04	`1.12.6-0ubuntu1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	brotli	source	sid	`0.3.0+dfsg-3`	not yet assigned	Not reported	[817233]
Debian	brotli	source	forky	`0.3.0+dfsg-3`	not yet assigned	Not reported	[817233]
Debian	brotli	source	trixie	`0.3.0+dfsg-3`	not yet assigned	Not reported	[817233]
Debian	brotli	source	bookworm	`0.3.0+dfsg-3`	not yet assigned	Not reported	[817233]
Ubuntu	oxide-qt	deb	14.04	`1.12.6-0ubuntu0.14.04.1`	Not reported	USN-2895-1	Not reported
Ubuntu	chromium-browser	deb	14.04	`48.0.2564.116-0ubuntu0.14.04.1.1111`	Not reported	UBUNTU-CVE-2016-1624	Not reported
Ubuntu	oxide-qt	deb	14.04	`1.12.6-0ubuntu0.14.04.1`	Not reported	UBUNTU-CVE-2016-1624	Not reported
Ubuntu	brotli	deb	16.04	`0.3.0+dfsg-2ubuntu1`	Not reported	UBUNTU-CVE-2016-1624	Not reported
Ubuntu	chromium-browser	deb	16.04	`48.0.2564.116-0ubuntu1.1229`	Not reported	UBUNTU-CVE-2016-1624	Not reported
Ubuntu	oxide-qt	deb	16.04	`1.12.6-0ubuntu1`	Not reported	UBUNTU-CVE-2016-1624	Not reported

[Debian bug #817233]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[brotli]Unknown
Source package: [brotli]
Details (2)
- 1.0.9-2+b6 · amd64 · bookworm
  Fixed · Fixed: 0.3.0+dfsg-3
  dsa · brotli · debian · bookworm; dsa · brotli · debian · 12
- 1.0.9-2+b6 · arm64 · bookworm
  Fixed · Fixed: 0.3.0+dfsg-3
  dsa · brotli · debian · bookworm; dsa · brotli · debian · 12
[libbrotli1]Unknown
Source package: [brotli]
Details (2)
- 1.0.9-2+b6 · amd64 · bookworm
  Fixed · Fixed: 0.3.0+dfsg-3
  dsa · brotli · debian · bookworm; dsa · brotli · debian · 12
- 1.0.9-2+b6 · arm64 · bookworm
  Fixed · Fixed: 0.3.0+dfsg-3
  dsa · brotli · debian · bookworm; dsa · brotli · debian · 12
[libbrotli-dev]Unknown
Source package: [brotli]
Details (2)
- 1.0.9-2+b6 · amd64 · bookworm
  Fixed · Fixed: 0.3.0+dfsg-3
  dsa · brotli · debian · bookworm; dsa · brotli · debian · 12
- 1.0.9-2+b6 · arm64 · bookworm
  Fixed · Fixed: 0.3.0+dfsg-3
  dsa · brotli · debian · bookworm; dsa · brotli · debian · 12
[python3-brotli]Unknown
Source package: [brotli]
Details (2)
- 1.0.9-2+b6 · amd64 · bookworm
  Fixed · Fixed: 0.3.0+dfsg-3
  dsa · brotli · debian · bookworm; dsa · brotli · debian · 12
- 1.0.9-2+b6 · arm64 · bookworm
  Fixed · Fixed: 0.3.0+dfsg-3
  dsa · brotli · debian · bookworm; dsa · brotli · debian · 12

[Debian 13 (Trixie)]

[brotli]Unknown
Details (2)
- 1.1.0-2+b7 · amd64 · trixie
  Fixed · Fixed: 0.3.0+dfsg-3
  dsa · brotli · debian · 13
- 1.1.0-2+b7 · arm64 · trixie
  Fixed · Fixed: 0.3.0+dfsg-3
  dsa · brotli · debian · 13
[libbrotli1]Unknown
Source package: [brotli]
Details (2)
- 1.1.0-2+b7 · amd64 · trixie
  Fixed · Fixed: 0.3.0+dfsg-3
  dsa · brotli · debian · 13
- 1.1.0-2+b7 · arm64 · trixie
  Fixed · Fixed: 0.3.0+dfsg-3
  dsa · brotli · debian · 13
[libbrotli-dev]Unknown
Source package: [brotli]
Details (2)
- 1.1.0-2+b7 · amd64 · trixie
  Fixed · Fixed: 0.3.0+dfsg-3
  dsa · brotli · debian · 13
- 1.1.0-2+b7 · arm64 · trixie
  Fixed · Fixed: 0.3.0+dfsg-3
  dsa · brotli · debian · 13
[python3-brotli]Unknown
Source package: [brotli]
Details (2)
- 1.1.0-2+b7 · amd64 · trixie
  Fixed · Fixed: 0.3.0+dfsg-3
  dsa · brotli · debian · 13
- 1.1.0-2+b7 · arm64 · trixie
  Fixed · Fixed: 0.3.0+dfsg-3
  dsa · brotli · debian · 13

Observed: Oct 23, 2026, 5:19:30 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]