Most recent entries from all

ALSA-2020:4952 — Important: freetype security update

Affected: AlmaLinux:8: freetype, AlmaLinux:8: freetype-devel

FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs efficiently.

Security Fix(es):

* freetype: Heap-based buffer overflow due to integer truncation in Load_SBit_Png (CVE-2020-15999)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2020-05385

Withdrawn: BELL-CVE-2020-15999 — CVE-2020-15999 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2020-avi-659 — De multiples vulnérabilités ont été découvertes dans Google Chrome. Elles permettent à un attaquant de provoquer un pro…

certfr-2020-avi-659

EUVD-2026-256055

fkie_cve-2020-15999

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

GHSA-pv36-h7jh-qm62 — Heap buffer overflow in CefSharp

Affected: NuGet: CefSharp.Common, NuGet: CefSharp.Wpf, NuGet: CefSharp.WinForms, NuGet: CefSharp.Wpf.HwndHost

### Impact A memory corruption bug(Heap overflow) in the FreeType font rendering library.

> This can be exploited by attackers to execute arbitrary code by using specially crafted fonts with embedded PNG images .

As per https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/

Google is aware of reports that an exploit for CVE-2020-15999 exists in the wild.

### Patches Upgrade to 85.3.130 or higher

### References - https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/ - https://www.zdnet.com/article/google-releases-chrome-security-update-to-patch-actively-exploited-zero-day/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15999 - https://magpcss.org/ceforum/viewtopic.php?f=10&t=17942

To review the `CEF/Chromium` patch see https://bitbucket.org/chromiumembedded/cef/commits/cd6cbe008b127990036945fb75e7c2c1594ab10d

gsd-2020-15999

ICSA-23-264-05 — Rockwell Automation Connected Components Workbench

Connected Components Workbench utilizes CefSharp version 81.3.100 that contains a use after free vulnerability in Google Chrome versions before 86.0.4240.198. If exploited, a remote threat actor could potentially perform a sandbox escape via a crafted HTML page. Connected Components Workbench utilizes CefSharp version 81.3.100 that contains a use after free vulnerability in Animation within Google Chrome before 98.0.4758.102. This vulnerability could potentially allow a remote threat actor to exploit heap corruption via a crafted HTML page. Connected Components Workbench utilizes CefSharp version 81.3.100 that contains an inappropriate implementation in V8 of Google Chrome before 86.0.4240.18. This vulnerability allows a remote threat actor to potentially exploit heap corruption via a crafted HTML page. Connected Components Workbench utilizes CefSharp version 81.3.100 that contains an inappropriate implementation in V8 of Google Chrome before 86.0.4240.198. This vulnerability allows a remote threat actor to potentially exploit heap corruption via a crafted HTML page. Connected Components Workbench utilizes CefSharp version 81.3.100 that contains a heap buffer overflow vulnerability in Freetype within Google Chrome before 86.0.4240.111. This vulnerability could allow a remote threat actor to potentially exploit heap corruption via a crafted HTML page.

msrc_CVE-2020-15999 — Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially explo…

msrc_CVE-2020-15999

OESA-2021-1103 — firefox security update

Affected: openEuler:20.03-LTS: firefox, openEuler:20.03-LTS-SP1: firefox

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fix(es): Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.(CVE-2020-15969) Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.(CVE-2020-15999)

openSUSE-SU-2020:1718-1 — Security update for chromium

Security update for chromium

RHSA-2020:4351 — Red Hat Security Advisory: chromium-browser security update

freetype: Heap-based buffer overflow due to integer truncation in Load_SBit_Png chromium-browser: Inappropriate implementation in Blink chromium-browser: Use after free in media chromium-browser: Use after free in PDFium chromium-browser: Use after free in printing

SUSE-SU-2020:14548-1 — Security update for MozillaFirefox

Security update for MozillaFirefox

UBUNTU-CVE-2020-15999

Affected: Ubuntu:Pro:14.04:LTS: freetype, Ubuntu:16.04:LTS: chromium-browser, Ubuntu:16.04:LTS: freetype, Ubuntu:16.04:LTS: android, Ubuntu:18.04:LTS: chromium-browser, Ubuntu:18.04:LTS: freetype, Ubuntu:20.04:LTS: freetype

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

WID-SEC-W-2022-1994 — Google Android Patchday Januar

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, beliebigen Programmcode auszuführen, einen Denial of Service Zustand herbeizuführen oder Informationen offenzulegen.