GHSA-pv36-h7jh-qm62MediumCVSS 6.5

Heap buffer overflow in CefSharp

Published
October 27, 2020
Last Modified
February 3, 2025

🔗 CVE IDs covered (1)

CVE-2020-15999 →

📋 Description

Impact

A memory corruption bug(Heap overflow) in the FreeType font rendering library.

This can be exploited by attackers to execute arbitrary code by using specially crafted fonts with embedded PNG images .

As per https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/

Google is aware of reports that an exploit for CVE-2020-15999 exists in the wild.

Patches

Upgrade to 85.3.130 or higher

References

  • https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/
  • https://www.zdnet.com/article/google-releases-chrome-security-update-to-patch-actively-exploited-zero-day/
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15999
  • https://magpcss.org/ceforum/viewtopic.php?f=10&t=17942

To review the CEF/Chromium patch see https://bitbucket.org/chromiumembedded/cef/commits/cd6cbe008b127990036945fb75e7c2c1594ab10d

🎯 Affected products4

  • nuget/CefSharp.Common:< 85.3.130
  • nuget/CefSharp.Wpf:< 85.3.130
  • nuget/CefSharp.WinForms:< 85.3.130
  • nuget/CefSharp.Wpf.HwndHost:< 85.3.130

🔗 References (19)