Lucene search
AmazonALAS2-2020-1565HistoryDec 08, 2020 - 8:55 p.m.
Important: freetype
2020-12-0820:55:00
alas.aws.amazon.com
41
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
7.8 High
AI Score
Confidence
High
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.026 Low
EPSS
Percentile
90.0%
Issue Overview:
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2020-15999)
Affected Packages:
freetype
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update freetype to update your system.
New Packages:
aarch64:
freetype-2.8-14.amzn2.1.aarch64
freetype-demos-2.8-14.amzn2.1.aarch64
freetype-devel-2.8-14.amzn2.1.aarch64
freetype-debuginfo-2.8-14.amzn2.1.aarch64
i686:
freetype-2.8-14.amzn2.1.i686
freetype-demos-2.8-14.amzn2.1.i686
freetype-devel-2.8-14.amzn2.1.i686
freetype-debuginfo-2.8-14.amzn2.1.i686
src:
freetype-2.8-14.amzn2.1.src
x86_64:
freetype-2.8-14.amzn2.1.x86_64
freetype-demos-2.8-14.amzn2.1.x86_64
freetype-devel-2.8-14.amzn2.1.x86_64
freetype-debuginfo-2.8-14.amzn2.1.x86_64
Additional References
Red Hat: CVE-2020-15999
Mitre: CVE-2020-15999
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 2 | aarch64 | freetype | < 2.8-14.amzn2.1 | freetype-2.8-14.amzn2.1.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | freetype-demos | < 2.8-14.amzn2.1 | freetype-demos-2.8-14.amzn2.1.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | freetype-devel | < 2.8-14.amzn2.1 | freetype-devel-2.8-14.amzn2.1.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | freetype-debuginfo | < 2.8-14.amzn2.1 | freetype-debuginfo-2.8-14.amzn2.1.aarch64.rpm |
| Amazon Linux | 2 | i686 | freetype | < 2.8-14.amzn2.1 | freetype-2.8-14.amzn2.1.i686.rpm |
| Amazon Linux | 2 | i686 | freetype-demos | < 2.8-14.amzn2.1 | freetype-demos-2.8-14.amzn2.1.i686.rpm |
| Amazon Linux | 2 | i686 | freetype-devel | < 2.8-14.amzn2.1 | freetype-devel-2.8-14.amzn2.1.i686.rpm |
| Amazon Linux | 2 | i686 | freetype-debuginfo | < 2.8-14.amzn2.1 | freetype-debuginfo-2.8-14.amzn2.1.i686.rpm |
| Amazon Linux | 2 | x86_64 | freetype | < 2.8-14.amzn2.1 | freetype-2.8-14.amzn2.1.x86_64.rpm |
| Amazon Linux | 2 | x86_64 | freetype-demos | < 2.8-14.amzn2.1 | freetype-demos-2.8-14.amzn2.1.x86_64.rpm |
Related
checkpoint_advisories
checkpoint_advisories
Google Chrome Memory Corruption (CVE-2020-15999)
2020-10-24 00:00:00
gitlab
gitlab
Out-of-bounds Write
2020-10-27 00:00:00
Out-of-bounds Write
2020-10-27 00:00:00
Out-of-bounds Write
2020-10-27 00:00:00
nessus
nessus
RHEL 8 : freetype (RHSA-2020:4950)
2020-11-05 00:00:00
EulerOS 2.0 SP8 : freetype (EulerOS-SA-2020-2510)
2020-12-14 00:00:00
githubexploit
githubexploit
Exploit for Out-of-bounds Write in Google Chrome
2020-10-28 16:16:25
Exploit for Out-of-bounds Write in Google Chrome
2020-12-30 19:58:33
Exploit for Out-of-bounds Write in Google Chrome
2020-12-30 18:02:23
osv
osv
freetype - security update
2020-10-25 00:00:00
Important: freetype security update
2020-11-05 08:26:43
Android Impact
2021-01-01 00:00:00
centos
centos
freetype security update
2020-11-06 21:57:09
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2020:2998-1)
2021-04-19 00:00:00
Debian: Security Advisory (DLA-2415-1)
2020-10-26 00:00:00
Debian: Security Advisory (DSA-4777-1)
2020-10-23 00:00:00
github
github
Heap buffer overflow in CefSharp
2020-10-27 19:47:38
fedora
fedora
[SECURITY] Fedora 31 Update: freetype-2.10.0-4.fc31
2020-11-07 01:28:39
[SECURITY] Fedora 33 Update: freetype-2.10.4-1.fc33
2020-10-25 01:01:39
[SECURITY] Fedora 32 Update: freetype-2.10.4-1.fc32
2020-10-25 01:21:04
suse
suse
Security update for freetype2 (important)
2020-10-26 00:00:00
Security update for freetype2 (important)
2020-10-25 00:00:00
Security update for chromium (important)
2020-10-24 00:00:00
oraclelinux
oraclelinux
freetype security update
2020-11-06 00:00:00
freetype security update
2020-11-13 00:00:00
thn
thn
New Chrome 0-day Under Active Attacks – Update Your Browser Now
2020-10-21 16:26:00
WARNING: Google Discloses Windows Zero-Day Bug Exploited in the Wild
2020-11-02 09:43:00
New Chrome Zero-Day Under Active Attacks – Update Your Browser
2020-11-03 09:33:00
prion
prion
Heap overflow
2020-11-03 03:15:00
veracode
veracode
Heap Buffer Overflow
2020-11-05 03:17:59
Heap Buffer Overflow
2020-10-25 12:34:11
cbl_mariner
cbl_mariner
CVE-2020-15999 affecting package freetype 2.9.1-5
2022-04-09 06:51:42
CVE-2020-15999 affecting package freetype 2.9.1-4
2022-03-19 16:40:53
debian
debian
[SECURITY] [DSA 4777-1] freetype security update
2020-10-21 19:00:07
[SECURITY] [DLA 2415-1] freetype security update
2020-10-25 21:59:56
[SECURITY] [DSA 4777-1] freetype security update
2020-10-21 19:00:07
redhat
redhat
(RHSA-2020:4907) Important: freetype security update
2020-11-04 09:39:15
(RHSA-2020:4952) Important: freetype security update
2020-11-05 08:26:43
(RHSA-2020:4951) Important: freetype security update
2020-11-05 08:24:50
cloudfoundry
cloudfoundry
USN-4593-1: FreeType vulnerability | Cloud Foundry
2020-11-19 00:00:00
qualysblog
qualysblog
Vulnerability Detection Pipeline (Beta)
2020-09-16 17:43:34
debiancve
debiancve
CVE-2020-15999
2020-11-03 03:15:00
ubuntu
ubuntu
FreeType vulnerability
2020-10-22 00:00:00
FreeType vulnerability
2020-10-20 00:00:00
ubuntucve
ubuntucve
CVE-2020-15999
2020-10-20 00:00:00
gentoo
gentoo
FreeType: Arbitrary code execution
2020-10-23 00:00:00
Opera: Multiple Vulnerabilities
2024-01-15 00:00:00
Chromium, Google Chrome: Multiple vulnerabilities
2020-11-11 00:00:00
rocky
rocky
freetype security update
2020-11-05 08:26:43
mageia
mageia
Updated freetype2 packages fix security vulnerability
2020-10-20 19:22:12
f5
f5
K000133070 : Freetype vulnerability CVE-2020-15999
2023-03-20 00:00:00
slackware
slackware
[slackware-security] freetype
2020-10-20 22:26:01
freebsd
freebsd
freetype2 -- heap buffer overlfow
2020-10-20 00:00:00
chromium -- multiple vulnerabilities
2020-10-20 00:00:00
cve
cve
CVE-2020-15999
2020-11-03 03:15:00
malwarebytes
malwarebytes
Google patches actively exploited zero-day bug that affects Chrome users
2020-10-26 10:58:14
Update your Chrome again as Google patches second zero-day in two weeks
2020-11-03 18:30:00
threatpost
threatpost
Microsoft IE Browser Death March Hastens
2020-10-26 22:26:57
Microsoft Patch Tuesday Update Fixes 17 Critical Bugs
2020-11-10 21:12:21
Google Patches Actively-Exploited Zero-Day Bug in Chrome Browser
2020-10-21 12:23:29
redhatcve
redhatcve
CVE-2020-15999
2020-10-21 18:33:33
archlinux
archlinux
[ASA-202010-10] freetype2: arbitrary code execution
2020-10-20 00:00:00
[ASA-202010-11] lib32-freetype2: arbitrary code execution
2020-10-20 00:00:00
[ASA-202011-12] firefox: multiple issues
2020-11-17 00:00:00
alpinelinux
alpinelinux
CVE-2020-15999
2020-11-03 03:15:00
almalinux
almalinux
Important: freetype security update
2020-11-05 08:26:43
photon
photon
Moderate Photon OS Security Update - PHSA-2022-0442
2022-02-16 00:00:00
Critical Photon OS Security Update - PHSA-2022-0364
2022-02-22 00:00:00
Important Photon OS Security Update - PHSA-2022-4.0-0156
2022-02-25 00:00:00
cisa_kev
cisa_kev
Google Chrome FreeType Heap Buffer Overflow Vulnerability
2021-11-03 00:00:00
attackerkb
attackerkb
CVE-2020-17087 Windows Kernel local privilege escalation 0day
2020-11-11 00:00:00
CVE-2020-15999 Chrome Freetype 0day
2020-11-03 00:00:00
ibm
ibm
Security Bulletin: IBM Analyst's Notebook Premium uses a component with known vulnerabilities (CVE-2020-16013, CVE-2020-16009, CVE-2020-15999)
2021-07-23 15:10:10
krebs
krebs
Patch Tuesday, November 2020 Edition
2020-11-11 01:56:41
ics
ics
Rockwell Automation Connected Components Workbench
2023-09-21 12:00:00
kaspersky
kaspersky
KLA12013 Multiple vulnerabilities in Opera
2020-10-29 00:00:00
KLA11986 Multiple vulnerabilities in Google Chrome
2020-10-20 00:00:00
KLA12012 Multiple vulnerabilities in Mozilla Thunderbird
2020-11-17 00:00:00
chrome
chrome
Stable Channel Update for Desktop
2020-10-20 00:00:00
googleprojectzero
googleprojectzero
In-the-Wild Series: October 2020 0-day discovery
2021-03-18 00:00:00
mozilla
mozilla
Security Vulnerabilities fixed in Thunderbird 78.5 — Mozilla
2020-11-17 00:00:00
Security Vulnerabilities fixed in Firefox ESR 78.5 — Mozilla
2020-11-17 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 10 package thunderbird version 78.5.0-alt1
2020-11-19 00:00:00
Security fix for the ALT Linux 10 package firefox-esr version 78.5.0-alt1
2020-11-16 00:00:00
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
7.8 High
AI Score
Confidence
High
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.026 Low
EPSS
Percentile
90.0%
Related for ALAS2-2020-1565