LiveActive security incident?Get immediate response
CVE Record

CVE-2016-10583: closure-utils is Utilities for Closure Library based projects.

closure-utils is Utilities for Closure Library based projects. closure-utils downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

closure-utils could download binary resources over unencrypted HTTP. A network-positioned attacker might replace the downloaded binary with their own, potentially causing code execution in environments that use the package. The provided sources do not include CVSS, precise affected versions, or a confirmed patch.

Executive priority

Treat as a dependency hygiene and build-chain risk. It is not cited as actively exploited, but possible code execution through tampered binaries justifies timely inventory and remediation where closure-utils is present.

Technical view

CVE-2016-10583 is a transport security weakness in closure-utils: binary resource downloads use HTTP, making integrity and authenticity dependent on the network path. The stated impact is possible RCE if an attacker can perform a man-in-the-middle substitution of the requested binary.

Likely exposure

Exposure is most likely in projects that depend on closure-utils and execute its downloaded binaries during install, build, or tooling workflows. The bundle does not identify affected versions, CPEs, or downstream products.

Exploitation context

The source bundle does not show active exploitation, and KEV is false. Exploitation requires an attacker positioned on the network path or between the user and remote server during an HTTP binary download.

Researcher notes

Evidence is sparse: no CVSS vector, CWE, affected version range, or patch detail appears in the provided bundle. Focus validation on dependency presence, HTTP binary retrieval behavior, and whether the retrieved binary is executed in trusted workflows.

Mitigation direction

  • Check vendor or package advisory guidance for fixed versions or migration advice.
  • Remove closure-utils where it is no longer required.
  • Pin dependencies and verify downloaded binary integrity where feasible.
  • Avoid build or install workflows that fetch executable binaries over HTTP.
  • Restrict dependency installation to trusted networks and controlled CI environments.

Validation and detection

  • Search manifests and lockfiles for closure-utils dependency entries.
  • Review CI and developer build logs for closure-utils binary downloads.
  • Confirm whether downloads use HTTP rather than HTTPS or verified artifacts.
  • Check whether any downloaded binary is executed during install or build.
  • Document any affected repositories and dependency paths.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2016-10583 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.