CVE-2020-15976

EPSS 1.49%
Veröffentlicht 03.11.2020 03:15:13
Zuletzt bearbeitet 21.11.2024 05:06:35
Erkennungen
Login

Use after free in WebXR in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 2 Referenzen 11

NVD 6 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Google ≫ Chrome Version < 86.0.4240.75

Google ≫ Android Version -

Opensuse ≫ Backports Sle Version 15.0 Update sp2

Debian ≫ Debian Linux Version 10.0

Fedoraproject ≫ Fedora Version 31

Fedoraproject ≫ Fedora Version 32

Fedoraproject ≫ Fedora Version 33

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.49%	0.714

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://www.debian.org/security/2021/dsa-4824

Third Party Advisory

https://security.gentoo.org/glsa/202101-30

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html

Third Party Advisory

Mailing List

https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html

Vendor Advisory

Release Notes

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/

https://crbug.com/1123522

Vendor Advisory

Permissions Required

https://nvd.nist.gov/vuln/detail/CVE-2020-15976

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-15976

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-15976

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2020-15976