GitHub Advisoryadvisory · NuGet

GHSA-m7mf-48hp-5qmr Inappropriate implementation in V8

HIGH Published 2020-12-02 Modified 2023-06-06 Official page ↗
Aliases
CVE-2020-16009
Ecosystem
NuGet
Packages
CefSharp.Common, CefSharp.Wpf, CefSharp.WinForms, CefSharp.Wpf.HwndHost
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-787
Reviewed
2020-12-02

Affected packages

• NuGet CefSharp.Common: < 86.0.241 → fixed in 86.0.241 • NuGet CefSharp.Wpf: < 86.0.241 → fixed in 86.0.241 • NuGet CefSharp.WinForms: < 86.0.241 → fixed in 86.0.241 • NuGet CefSharp.Wpf.HwndHost: < 86.0.241 → fixed in 86.0.241

Description

CVE-2020-16009: Inappropriate implementation in V8 • https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16009 Google is aware of reports that exploits for CVE-2020-16009 exist in the wild. Allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. There is currently little to no public information on the issue other than it has been flagged as `High` severity.

Related

Alias · CVE (1)

  • CVE-2020-16009 Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption… vulnerability

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References