Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-16009

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Published

2020-11-03T03:15:15.527

Last Modified

2025-02-05T13:56:18.173

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.6

Impact Score

6.4

Weaknesses

Type: Primary
CWE-787
CWE-843
Type: Secondary
CWE-843

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	cefsharp	cefsharp	< 86.0.241	Yes
Application	google	chrome	< 86.0.4240.183	Yes
Application	microsoft	edge	< 86.0.622.63	Yes
Application	microsoft	edge_chromium	< 86.0.4240.183	Yes
Application	opensuse	backports_sle	15.0	Yes
Application	opensuse	backports_sle	15.0	Yes
Operating System	opensuse	leap	15.1	Yes
Operating System	opensuse	leap	15.2	Yes
Operating System	fedoraproject	fedora	32	Yes
Operating System	fedoraproject	fedora	33	Yes
Operating System	debian	debian_linux	10.0	Yes

References

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html Broken Link, Mailing List, Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00017.html Broken Link, Mailing List, Third Party Advisory ([email protected])
http://packetstormsecurity.com/files/159974/Chrome-V8-Turbofan-Type-Confusion.html Exploit, Third Party Advisory, VDB Entry ([email protected])
https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html Release Notes, Vendor Advisory ([email protected])
https://crbug.com/1143772 Exploit, Issue Tracking ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S4XYJ7B6OXHZNYSA5J3DBUOFEC6WCAGW/ Release Notes ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/ Release Notes ([email protected])
https://security.gentoo.org/glsa/202011-12 Third Party Advisory ([email protected])
https://www.debian.org/security/2021/dsa-4824 Mailing List, Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html Broken Link, Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00017.html Broken Link, Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://packetstormsecurity.com/files/159974/Chrome-V8-Turbofan-Type-Confusion.html Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://crbug.com/1143772 Exploit, Issue Tracking (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S4XYJ7B6OXHZNYSA5J3DBUOFEC6WCAGW/ Release Notes (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/ Release Notes (af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/202011-12 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.debian.org/security/2021/dsa-4824 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)