Google Chrome FreeType Heap Buffer Overflow Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| CefSharp.Common | < 85.3.130 | 85.3.130 |
| CefSharp.WinForms | < 85.3.130 | 85.3.130 |
| CefSharp.Wpf | < 85.3.130 | 85.3.130 |
| CefSharp.Wpf.HwndHost | < 85.3.130 | 85.3.130 |
| freetype | ≥ 2.6.0, < 2.10.4 | 2.10.4 |
| chrome | < 86.0.4240.111 | 86.0.4240.111 |
| backports sle | = 15.0 |
A memory corruption bug(Heap overflow) in the FreeType font rendering library.
This can be exploited by attackers to execute arbitrary code by using specially crafted fonts with embedded PNG images .
As per https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/
Google is aware of reports that an exploit for CVE-2020-15999 exists in the wild.
Upgrade to 85.3.130 or higher
To review the CEF/Chromium patch see https://bitbucket.org/chromiumembedded/cef/commits/cd6cbe008b127990036945fb75e7c2c1594ab10d
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free