Vulnerability · Published May 4, 2020 · Assigned by Google
CVE-2020-8896Buffer Overflow in Google Earth Pro
Medium 4.2
In plain English
A medium-severity memory corruption in Google Earth Pro from Google LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)0.4%top 65.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A Buffer Overflow vulnerability in the khcrypt implementation in Google Earth Pro versions up to and including 7.3.2 allows an attacker to perform a Man-in-the-Middle attack using a specially crafted key to read data past the end of the buffer used to hold it. Mitigation: Update to Google Earth Pro 7.3.3.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google LLC | Google Earth Pro | stable – through 7.3.2 |
Weakness: CWE-119 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
References
- https://support.google.com/earth/answer/40901 x_refsource_CONFIRM