CRITICAL🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2020-15999

CVSS 9.6v3.1pub. 2020-11-03upd. 2025-10-24

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Debian
OS
Debian
10.0
Fedora Project Fedora
OS
Fedoraproject
31
Freetype
APP
Freetype
2.6.0 – 2.10.4 (bez)
Google Chrome
APP
Google
< 86.0.4240.111
Netapp Ontap Select Deploy Administration Utility
APP
Netapp
wszystkie wersje
Opensuse Backports Sle
APP
Opensuse
15.0

CISA KEV — detailsi

Vendori: Google ↗
Producti: Chrome FreeType
Added to KEVi: November 3, 2021
Remediation deadline (US Federal)i: November 17, 2021(overdue)

🔧Advisory Google↗🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.

🔴