CVE-2020-15999: Heap buffer overflow in CefSharp
(updated )
A memory corruption bug(Heap overflow) in the FreeType font rendering library.
This can be exploited by attackers to execute arbitrary code by using specially crafted fonts with embedded PNG images .
As per https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/
Google is aware of reports that an exploit for CVE-2020-15999 exists in the wild.
References
- chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html
- crbug.com/1139963
- github.com/advisories/GHSA-pv36-h7jh-qm62
- github.com/cefsharp/CefSharp
- github.com/cefsharp/CefSharp/security/advisories/GHSA-pv36-h7jh-qm62
- googleprojectzero.blogspot.com/p/rca-cve-2020-15999.html
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3QVIGAAJ4D62YEJAJJWMCCBCOQ6TVL7
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J3QVIGAAJ4D62YEJAJJWMCCBCOQ6TVL7
- nvd.nist.gov/vuln/detail/CVE-2020-15999
- security.gentoo.org/glsa/202011-12
- security.gentoo.org/glsa/202012-04
- security.gentoo.org/glsa/202401-19
- security.netapp.com/advisory/ntap-20240812-0001
- www.debian.org/security/2021/dsa-4824
- www.nuget.org/packages/CefSharp.Common
- www.nuget.org/packages/CefSharp.WinForms
- www.nuget.org/packages/CefSharp.Wpf
- www.nuget.org/packages/CefSharp.Wpf.HwndHost
Code Behaviors & Features
Detect and mitigate CVE-2020-15999 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →