8.8

CVE-2020-6416

Exploit
Insufficient data validation in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Google ≫ Chrome Version < 80.0.3987.87
Fedoraproject ≫ Fedora Version 30
Fedoraproject ≫ Fedora Version 31
Debian ≫ Debian Linux Version 9.0
Debian ≫ Debian Linux Version 10.0
Suse ≫ Package Hub Version -
   Suse ≫ Linux Enterprise Version 12.0
Opensuse ≫ Backports Sle Version 15.0 Update sp1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.99% 0.781
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html
Third Party Advisory
Mailing List
https://access.redhat.com/errata/RHSA-2020:0514
Third Party Advisory
https://security.gentoo.org/glsa/202003-08
Third Party Advisory
https://www.debian.org/security/2020/dsa-4638
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3B5RWJQD5LA45MYLLR55KZJOJ5NVZGP/
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
Vendor Advisory
https://crbug.com/1031895
Patch
Vendor Advisory
Exploit
Issue Tracking