GHSA-pv36-h7jh-qm62

    Dashboard / Vulnerabilities / GHSA-pv36-h7jh-qm62

    GHSA-pv36-h7jh-qm62

    Published: 27 Oct 2020Last Modified: 3 Feb 2025

    Summary: Heap buffer overflow in CefSharp

    Details: ### Impact A memory corruption bug(Heap overflow) in the FreeType font rendering library. > This can be exploited by attackers to execute arbitrary code by using specially crafted fonts with embedded PNG images . As per https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/ Google is aware of reports that an exploit for CVE-2020-15999 exists in the wild. ### Patches Upgrade to 85.3.130 or higher ### References - https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/ - https://www.zdnet.com/article/google-releases-chrome-security-update-to-patch-actively-exploited-zero-day/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15999 - https://magpcss.org/ceforum/viewtopic.php?f=10&t=17942 To review the `CEF/Chromium` patch see https://bitbucket.org/chromiumembedded/cef/commits/cd6cbe008b127990036945fb75e7c2c1594ab10d

    References: https://github.com/cefsharp/CefSharp/security/advisories/GHSA-pv36-h7jh-qm62, https://nvd.nist.gov/vuln/detail/CVE-2020-15999, https://www.nuget.org/packages/CefSharp.Wpf.HwndHost, https://www.nuget.org/packages/CefSharp.Wpf, https://www.nuget.org/packages/CefSharp.WinForms, https://www.nuget.org/packages/CefSharp.Common, https://www.debian.org/security/2021/dsa-4824, https://security.netapp.com/advisory/ntap-20240812-0001, https://security.gentoo.org/glsa/202401-19, https://security.gentoo.org/glsa/202012-04, https://security.gentoo.org/glsa/202011-12, https://lists.fedoraproject.org/archives/list/[email protected]/message/J3QVIGAAJ4D62YEJAJJWMCCBCOQ6TVL7, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3QVIGAAJ4D62YEJAJJWMCCBCOQ6TVL7, https://googleprojectzero.blogspot.com/p/rca-cve-2020-15999.html, https://github.com/cefsharp/CefSharp, https://crbug.com/1139963, https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html, http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html, http://seclists.org/fulldisclosure/2020/Nov/33

    Affected packages

    Package

    Name: CefSharp.Common

    Purl: pkg:nuget/CefSharp.Common

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -85.3.130

    Affected versions

    31.0.0-pre1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-pv36-h7jh-qm62 | CVE-DB