~ / search / GHSA-pv36-h7jh-qm62

GHSA-pv36-h7jh-qm62

Heap buffer overflow in CefSharp

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-15999

Packages

EcosystemPackageAffectedFixed in
NuGet CefSharp.Common < 85.3.130 85.3.130
NuGet CefSharp.Wpf < 85.3.130 85.3.130
NuGet CefSharp.WinForms < 85.3.130 85.3.130
NuGet CefSharp.Wpf.HwndHost < 85.3.130 85.3.130

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A memory corruption bug(Heap overflow) in the FreeType font rendering library. > This can be exploited by attackers to execute arbitrary code by using specially crafted fonts with embedded PNG images . As per https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/ Google is aware of reports that an exploit for CVE-2020-15999 exists in the wild. ### Patches Upgrade to 85.3.130 or higher ### References - https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/ - https://www.zdnet.com/article/google-releases-chrome-security-update-to-patch-actively-exploited-zero-day/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15999 - https://magpcss.org/ceforum/viewtopic.php?f=10&t=17942 To review the `CEF/Chromium` patch see https://bitbucket.org/chromiumembedded/cef/commits/cd6cbe008b127990036945fb75e7c2c1594ab10d

References

External links from the advisory. They lead to third-party sites.