Fedora EPEL 8 update for chromium

1) Out-of-bounds write

EUVDB-ID: #VU27117

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6458

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in PDFium. A remote attacker can create a specially crafted PDF file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU27110

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6459

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the payments component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU27116

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6460

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in URL formatting. A remote attacker can trick a victim to click on a specially crafted URL and compromise the affected system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use-after-free

EUVDB-ID: #VU26658

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6454

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the extensions component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

EUVDB-ID: #VU26659

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6423

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the audio component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Out-of-bounds read

EUVDB-ID: #VU26660

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6455

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the WebSQL component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Type Confusion

EUVDB-ID: #VU26661

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6430

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a type confusion error and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Input validation error

EUVDB-ID: #VU26670

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6456

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in clipboard in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU26662

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6431

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in full screen in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU26664

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6433

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in extensions in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Use-after-free

EUVDB-ID: #VU26665

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6434

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within devtools in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU26675

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6435

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in extensions in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Use-after-free

EUVDB-ID: #VU26666

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6436

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within window management in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Improperly implemented security check for standard

EUVDB-ID: #VU26671

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6437

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

"

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in WebView in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU26667

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6438

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in extensions in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU26668

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6439

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in navigations in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Improperly implemented security check for standard

EUVDB-ID: #VU26672

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6440

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

"

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in extensions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU26669

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6441

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in omnibox in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Improperly implemented security check for standard

EUVDB-ID: #VU26673

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6442

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

"

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in cache in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Input validation error

EUVDB-ID: #VU26674

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6443

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in developer tools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Use of uninitialized resource

EUVDB-ID: #VU26679

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6444

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to usage of uninitialized resources in WebRTC in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU26676

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6445

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in trusted types in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU26677

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6446

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in trusted types in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Improperly implemented security check for standard

EUVDB-ID: #VU26678

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6447

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

"

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in developer tools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Use-after-free

EUVDB-ID: #VU26680

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6448

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in V8 in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU26663

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6432

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in navigations in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Use-after-free

EUVDB-ID: #VU26969

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6457

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the speech recognizer component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Use-after-free

EUVDB-ID: #VU26495

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6450

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing web content in WebAudio component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Use-after-free

EUVDB-ID: #VU26496

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6451

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing web content in WebAudio component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Heap-based buffer overflow

EUVDB-ID: #VU26497

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6452

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing web content in media component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Use-after-free

EUVDB-ID: #VU26198

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6422

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within WebGL in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Use-after-free

EUVDB-ID: #VU26199

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6424

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within media component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU26204

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6425

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to insufficient policy enforcement in extensions in Google Chrome. A remote attacker can trick a victim to install a specially crafted extension and execute arbitrary code on the system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Input validation error

EUVDB-ID: #VU26205

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6426

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation of V8 engine in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Use-after-free

EUVDB-ID: #VU26200

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6427

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within audio component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Use-after-free

EUVDB-ID: #VU26201

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6428

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within audio component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Use-after-free

EUVDB-ID: #VU26202

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6429

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within audio component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Out-of-bounds read

EUVDB-ID: #VU25856

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-20503

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in sctp_load_addresses_from_init in usrsctp. A remote attacker can pass specially crafted data to the application, trigger out-of-bounds read error and read contents of memory on the system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Use-after-free

EUVDB-ID: #VU26203

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6449

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within audio component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Resource exhaustion

EUVDB-ID: #VU25011

Risk: Medium

CVSSv4.0: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-20446

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect processing of nested patterns within SVG files in xml.rs in GNOME librsvg. A remote attacker can create a specially crafted SVG file, pass if to the affected application, trigger resource exhaustion and perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Integer overflow

EUVDB-ID: #VU24921

Risk: High

CVSSv4.0: 5.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6381

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in JavaScript engine. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Type confusion

EUVDB-ID: #VU24927

Risk: High

CVSSv4.0: 5.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6382

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in JavaScript engine. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Type Confusion

EUVDB-ID: #VU25505

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6383

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in V8. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Use-after-free

EUVDB-ID: #VU25506

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6384

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in WebAudio component. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Security restrictions bypass

EUVDB-ID: #VU24928

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6385

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security features.

The vulnerability exists due to insufficient policy enforcement in storage engine. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the affected system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Use-after-free

EUVDB-ID: #VU25537

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6386

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in speech component. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Out-of-bounds write

EUVDB-ID: #VU24929

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6387

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in WebRTC component. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Out-of-bounds write

EUVDB-ID: #VU24931

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6388

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in WebAudio component. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Out-of-bounds write

EUVDB-ID: #VU24930

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6389

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in WebRTC component. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Out-of-bounds write

EUVDB-ID: #VU24932

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6390

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in streams component. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Input validation error

EUVDB-ID: #VU24949

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6391

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input in Blink component. A remote attacker can create a specially crafted webpage, trick the victim into visiting it and bypass implemented security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Security restrictions bypass

EUVDB-ID: #VU24950

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6392

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to insufficient policy enforcement in extensions. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass certain security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Security restrictions bypass

EUVDB-ID: #VU24951

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6393

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to insufficient policy enforcement in Blink. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass certain security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Security restrictions bypass

EUVDB-ID: #VU24952

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6394

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to insufficient policy enforcement in Blink. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass certain security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Out-of-bounds read

EUVDB-ID: #VU24957

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6395

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in JavaScript engine. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Security restrictions bypass

EUVDB-ID: #VU24959

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6396

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to inappropriate implementation in Skia. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass certain security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Insufficient UI Warning of Dangerous Operations

EUVDB-ID: #VU24960

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6397

CWE-ID: N/A

Exploit availability: No

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect implementation of UI security mechanisms in sharing component. A remote attacker can create a specially crafted website, trick the victim into visiting it and perform a spoofing attack.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Use of uninitialized resource

EUVDB-ID: #VU24962

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6398

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in PDFium. A remote attacker can pass specially crafted data to the application, trigger uninitialized usage of resources and bypass implemented security mechanisms.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Security restrictions bypass

EUVDB-ID: #VU24953

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6399

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to insufficient policy enforcement in AppCache. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass certain security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Origin validation error

EUVDB-ID: #VU24963

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6400

CWE-ID: CWE-346 - Origin Validation Error

Exploit availability: No

The vulnerability allows a remote attacker to gain access to bypass implemented security restrictions.

The vulnerability exists due to incorrect implementation of CORS policies. A remote attacker can bypass implemented security restrictions and interact with web applications outside of the allowed domain.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Input validation error

EUVDB-ID: #VU24964

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6401

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input in Omnibox component. A remote attacker can create a specially crafted webpage, trick the victim into visiting it and bypass implemented security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Security restrictions bypass

EUVDB-ID: #VU24967

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6402

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to insufficient policy enforcement in downloads. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass certain security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Insufficient UI Warning of Dangerous Operations

EUVDB-ID: #VU24961

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6403

CWE-ID: N/A

Exploit availability: No

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect implementation of UI security mechanisms in Omnibox component. A remote attacker can create a specially crafted website, trick the victim into visiting it and perform a spoofing attack.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Security restrictions bypass

EUVDB-ID: #VU24968

Risk: Low

CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2020-6404

CWE-ID: CWE-254 - Security Features

Exploit availability: Yes

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to inappropriate implementation in Blink. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass certain security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

65) Out-of-bounds read

EUVDB-ID: #VU24958

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6405

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in SQLite. A remote attacker can pass specially crafted input to the application, trigger out-of-bounds read error and read contents of memory on the system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Use-after-free

EUVDB-ID: #VU24973

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6406

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a use-after-free error within the audio component. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Out-of-bounds write

EUVDB-ID: #VU25566

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6407

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in streams. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger out-of-bounds write and execute arbitrary code on the target system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Security restrictions bypass

EUVDB-ID: #VU24954

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6408

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to insufficient policy enforcement in CORS. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass certain security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Security restrictions bypass

EUVDB-ID: #VU24969

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6409

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to inappropriate implementation in Omnibox. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass certain security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Security restrictions bypass

EUVDB-ID: #VU24955

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6410

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to insufficient policy enforcement in navigation. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass certain security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Input validation error

EUVDB-ID: #VU24965

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6411

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input in Omnibox component. A remote attacker can create a specially crafted webpage, trick the victim into visiting it and bypass implemented security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Input validation error

EUVDB-ID: #VU24966

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6412

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input in Omnibox component. A remote attacker can create a specially crafted webpage, trick the victim into visiting it and bypass implemented security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Security restrictions bypass

EUVDB-ID: #VU24970

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6413

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to inappropriate implementation in Blink. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass certain security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Security restrictions bypass

EUVDB-ID: #VU24956

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6414

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to insufficient policy enforcement in Safe Browsing. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass certain security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Security restrictions bypass

EUVDB-ID: #VU24971

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6415

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to inappropriate implementation in JavaScript. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass certain security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Input validation error

EUVDB-ID: #VU24974

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6416

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input in streams. A remote attacker can create a specially crafted webpage, trick the victim into visiting it and bypass implemented security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Security restrictions bypass

EUVDB-ID: #VU24972

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6417

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to inappropriate implementation in installer component. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass certain security restrictions.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Type Confusion

EUVDB-ID: #VU25567

Risk: Critical

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2020-6418

CWE-ID: CWE-843 - Type confusion

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in V8 component. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: This vulnerability is being actively exploited in the wild.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

79) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU25754

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6420

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in media. A remote attacker can bypass implemented security restrictions and compromise the affected system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Integer overflow

EUVDB-ID: #VU26149

Risk: High

CVSSv4.0: 5.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-10531

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in UnicodeString::doAppend() function in common/unistr.cpp. A remote attacker can pass specially crafted string to the application that is using the vulnerable library, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's repository.

Fedora: 8

chromium: before 81.0.4044.122-1.el8

• cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:chromium:*:*:*:*:*:fedora:*:*

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-72116e7775

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.