CVE-2020-15999criticalunder attackCWE-120

CVE-2020-15999: critical vulnerability in Google Chrome

Published · Updated

90Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.6epss 64%
from disclosure to weapon1 days
Published on NVDNov 3
1st PoC+1d
CISA KEV+365d
exploitation probability
64%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
5 public exploit(s)
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
15 products (162 components)
Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux BaseOS EUS (v. 8.1) · Red Hat Enterprise Linux BaseOS EUS (v. 8.2) · Red Hat Enterprise Linux Server (v. 7) · Red Hat Enterprise Linux BaseOS E4S (v. 8.0) · and others 10
fix ↗
Not affected
3 products (10 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 6 · Red Hat Advanced Cluster Management for Kubernetes 2 · Red Hat Enterprise Linux 5
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

A flaw in the font-handling library (Freetype) used by Chrome allows an attacker to corrupt computer memory through a specially designed webpage. This could enable the attacker to execute malicious code or crash the browser.

Technical detail

Heap buffer overflow in Freetype's font parsing allows a remote attacker to write beyond allocated memory boundaries via crafted HTML. Exploitation requires user to visit a malicious webpage; successful exploitation results in heap corruption leading to potential code execution or denial of service.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
Google · Chrome
public PoCs found — 5
githubgithub.com/oxfemale/CVE-2020-15999★ 3githubgithub.com/Marmeus/CVE-2020-15999★ 2githubgithub.com/maarlo/CVE-2020-15999★ 1vulncheckvulncheck.com/xdb/8566ea6250e8unverifiedvulncheckvulncheck.com/xdb/5cca2ba03cd1unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Google Chrome

In the same product, most dangerous first.

CVE-2023-4863HIGHCVE-2023-4863EPSS 100.0%KEVCVE-2018-17463HIGHCVE-2018-17463EPSS 84.6%KEVCVE-2021-21224HIGHCVE-2021-21224EPSS 84.2%KEVCVE-2020-6418HIGHCVE-2020-6418EPSS 78.8%KEVCVE-2022-2294HIGHCVE-2022-2294EPSS 70.5%KEVCVE-2021-21220HIGHCVE-2021-21220EPSS 70.4%KEV
References
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.htmlhttps://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.htmlhttps://crbug.com/1139963http://seclists.org/fulldisclosure/2020/Nov/33https://googleprojectzero.blogspot.com/p/rca-cve-2020-15999.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3QVIGAAJ4D62YEJAJJWMCCBCOQ6TVL7/https://security.gentoo.org/glsa/202011-12https://security.gentoo.org/glsa/202012-04https://security.gentoo.org/glsa/202401-19https://security.netapp.com/advisory/ntap-20240812-0001/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15999https://www.debian.org/security/2021/dsa-4824