ByteOS Network

NVD Vulnerability Details :

CVE-2020-15999

Analyzed

Known KEV

More Info Official Page

Source-chrome-cve-admin@google.com

View Known Exploited Vulnerability (KEV) details

Published At-03 Nov, 2020 | 03:15

Updated At-05 Feb, 2025 | 14:37

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2021-11-03	2021-11-17	Google Chrome FreeType Heap Buffer Overflow Vulnerability	Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.6	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Secondary	3.1	9.6	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:N/A:P

CPE Matches

Google LLC

>>chrome>>Versions before 86.0.4240.111(exclusive)

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

freetype>>freetype>>Versions from 2.6.0(inclusive) to 2.10.4(exclusive)

cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>10.0

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Fedora Project

>>fedora>>31

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

openSUSE

>>backports_sle>>15.0

cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*

NetApp, Inc.

>>ontap_select_deploy_administration_utility>>-

cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-787	Primary	nvd@nist.gov
CWE-120	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html	chrome-cve-admin@google.com	Broken Link Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2020/Nov/33	chrome-cve-admin@google.com	Mailing List Not Applicable Third Party Advisory
https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html	chrome-cve-admin@google.com	Third Party Advisory
https://crbug.com/1139963	chrome-cve-admin@google.com	Exploit Issue Tracking Third Party Advisory
https://googleprojectzero.blogspot.com/p/rca-cve-2020-15999.html	chrome-cve-admin@google.com	Exploit Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3QVIGAAJ4D62YEJAJJWMCCBCOQ6TVL7/	chrome-cve-admin@google.com	Release Notes
https://security.gentoo.org/glsa/202011-12	chrome-cve-admin@google.com	Third Party Advisory
https://security.gentoo.org/glsa/202012-04	chrome-cve-admin@google.com	Third Party Advisory
https://security.gentoo.org/glsa/202401-19	chrome-cve-admin@google.com	Third Party Advisory
https://www.debian.org/security/2021/dsa-4824	chrome-cve-admin@google.com	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html	af854a3a-2127-422b-91ae-364da2661108	Broken Link Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2020/Nov/33	af854a3a-2127-422b-91ae-364da2661108	Mailing List Not Applicable Third Party Advisory
https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://crbug.com/1139963	af854a3a-2127-422b-91ae-364da2661108	Exploit Issue Tracking Third Party Advisory
https://googleprojectzero.blogspot.com/p/rca-cve-2020-15999.html	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3QVIGAAJ4D62YEJAJJWMCCBCOQ6TVL7/	af854a3a-2127-422b-91ae-364da2661108	Release Notes
https://security.gentoo.org/glsa/202011-12	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://security.gentoo.org/glsa/202012-04	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://security.gentoo.org/glsa/202401-19	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://security.netapp.com/advisory/ntap-20240812-0001/	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://www.debian.org/security/2021/dsa-4824	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History