GHSA-PV36-H7JH-QM62 Heap buffer overflow in CefSharp

🗓️ 27 Oct 2020 19:47:38Reported by GoogleType

osv🔗 osv.dev👁 73 Views

Heap buffer overflow in CefSharp, impacting FreeType font rendering library, allowing execution of arbitrary code via crafted fonts with PNG images. Exploit for CVE-2020-15999 reported in the wild. Update to 85.3.130 or highe

Reporter	Title	Published	Views	Family All 298
GithubExploit	Exploit for Classic Buffer Overflow in Google Chrome	30 Dec 202019:58	–	githubexploit
FreeBSD	freetype2 -- heap buffer overlfow	20 Oct 202000:00	–	freebsd
FreeBSD	chromium -- multiple vulnerabilities	20 Oct 202000:00	–	freebsd
ALT Linux	Security fix for the ALT Linux 10 package thunderbird version 78.5.0-alt1	19 Nov 202000:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package firefox-esr version 78.5.0-alt1	16 Nov 202000:00	–	altlinux
Tenable Nessus	Google Chrome < 86.0.4240.111 Multiple Vulnerabilities	20 Oct 202000:00	–	nessus
Tenable Nessus	Amazon Linux 2022 : freetype, freetype-demos, freetype-devel (ALAS2022-2022-033)	11 Dec 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2022 : freetype, freetype-demos, freetype-devel (ALAS2022-2022-154)	20 Oct 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : freetype, freetype-demos, freetype-devel (ALAS2023-2023-074)	21 Mar 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : freetype (ALAS-2020-1565)	9 Dec 202000:00	–	nessus

Source	Link
github	www.github.com/cefsharp/CefSharp/security/advisories/GHSA-pv36-h7jh-qm62
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-15999
nuget	www.nuget.org/packages/CefSharp.Wpf.HwndHost
nuget	www.nuget.org/packages/CefSharp.Wpf
nuget	www.nuget.org/packages/CefSharp.WinForms
nuget	www.nuget.org/packages/CefSharp.Common
debian	www.debian.org/security/2021/dsa-4824
security	www.security.netapp.com/advisory/ntap-20240812-0001
security	www.security.gentoo.org/glsa/202401-19
security	www.security.gentoo.org/glsa/202012-04

03 Feb 2025 15:46Current

8.8High risk

Vulners AI Score8.8

CVSS 3.16.5

EPSS0.5063