Actively exploited · Published Nov 3, 2020 · Assigned by Chrome
CVE-2020-15999
Critical 9.6 Exploited
In plain English
A critical-severity buffer overflow in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 63.9% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Nov 17, 2021.
Official description
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | freetype | 2.9.1-4.el8_3.1 | ALSA-2020:4952 |
| AlmaLinux:8 | freetype-devel | 2.9.1-4.el8_3.1 | ALSA-2020:4952 |
| Alpine:v3.20 | firefox | 83.0-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.21 | firefox | 83.0-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.22 | firefox | 83.0-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.23 | firefox | 83.0-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.20 | firefox-esr | 78.5.0-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.21 | firefox-esr | 78.5.0-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.22 | firefox-esr | 78.5.0-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.23 | firefox-esr | 78.5.0-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.20 | freetype | 2.10.4-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.21 | freetype | 2.10.4-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.22 | freetype | 2.10.4-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.23 | freetype | 2.10.4-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.24 | freetype | 2.10.4-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.21 | librewolf | 83.0-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.22 | librewolf | 83.0-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.23 | librewolf | 83.0-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.24 | librewolf | 83.0-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.20 | thunderbird | 78.5.1-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.21 | thunderbird | 78.5.1-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.22 | thunderbird | 78.5.1-r0 | ALPINE-CVE-2020-15999 |
| Alpine:v3.23 | thunderbird | 78.5.1-r0 | ALPINE-CVE-2020-15999 |
| Debian:12 | freetype | 2.10.2+dfsg-4 | DEBIAN-CVE-2020-15999 |
| Debian:13 | freetype | 2.10.2+dfsg-4 | DEBIAN-CVE-2020-15999 |
| Debian:14 | freetype | 2.10.2+dfsg-4 | DEBIAN-CVE-2020-15999 |
| NuGet | cefsharp.common | 85.3.130 | GHSA-pv36-h7jh-qm62 |
| NuGet | cefsharp.winforms | 85.3.130 | GHSA-pv36-h7jh-qm62 |
| NuGet | cefsharp.wpf | 85.3.130 | GHSA-pv36-h7jh-qm62 |
| NuGet | cefsharp.wpf.hwndhost | 85.3.130 | GHSA-pv36-h7jh-qm62 |
| Rocky Linux:8 | freetype | 0:2.9.1-4.el8_3.1 | RLSA-2020:4952 |
Affected products (as reported)
Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://crbug.com/1139963
- https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html
- openSUSE-SU-2020:1829 vendor-advisory
- FEDORA-2020-6b35849edd vendor-advisory
- GLSA-202011-12 vendor-advisory
- 20201118 TCMalloc viewer/dumper - TCMalloc Inspector Tool mailing-list
- GLSA-202012-04 vendor-advisory
- DSA-4824 vendor-advisory
- https://googleprojectzero.blogspot.com/p/rca-cve-2020-15999.html
- GLSA-202401-19 vendor-advisory
- https://security.netapp.com/advisory/ntap-20240812-0001/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15999 government-resource