CVE-2020-15999
CRITICAL CISA KEV EPSS 98.8%
Published Nov 3, 20205y ago · Modified Jun 17, 20262w ago
9.6 CVSS 3.1
Published Nov 3, 2020 5y ago
Last Modified Jun 17, 2026 2w ago
KEV Listed Nov 3, 2021 4y ago
KEV Due Nov 17, 2021 1687d overdue
Description
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality High
Integrity High
Availability High
Threat Intelligence
CISA Known Exploited Overdue 1687d
- Added
- Nov 3, 2021
- Due
- Nov 17, 2021
Apply updates per vendor instructions.
EPSS Exploit Probability
98.8% percentile
Exploit & Patch Status
Actively Exploited (KEV)
No Patch Available
Weaknesses 2
CWE-120
CWE-787 Out-of-bounds Write Memory Safety
Affected Products 6
References 12
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html
- seclists.org http://seclists.org/fulldisclosure/2020/Nov/33
- chromereleases.googleblog.com https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html
- crbug.com https://crbug.com/1139963
- googleprojectzero.blogspot.com https://googleprojectzero.blogspot.com/p/rca-cve-2020-15999.html
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3QVIGAAJ4D62YEJAJJWMCCBCOQ6TVL7/
- security.gentoo.org https://security.gentoo.org/glsa/202011-12
- security.gentoo.org https://security.gentoo.org/glsa/202012-04
- security.gentoo.org https://security.gentoo.org/glsa/202401-19
- security.netapp.com https://security.netapp.com/advisory/ntap-20240812-0001/
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15999
- debian.org https://www.debian.org/security/2021/dsa-4824
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.