Use-after-free in Google Chrome - CVE-2020-6377

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU24067

Use-after-free in Google Chrome - CVE-2020-6377

Published: January 7, 2020 / Updated: January 13, 2020


Vulnerability identifier: #VU24067
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-6377
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the audio component. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


Affected software

Google Chrome
Gentoo Linux
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Fedora
chromium
www-client/chromium
www-client/google-chrome

How to mitigate CVE-2020-6377

Install updates from vendor's website.

Google Chrome - update to 79.0.3945.117
chromium - addressed in versions 79.0.3945.117-1.el7, 79.0.3945.117-1.el8, 79.0.3945.117-1.fc30, 79.0.3945.117-1.fc31, 79.0.3945.130-1.el7, 79.0.3945.130-1.el8
www-client/chromium - update to 80.0.3987.132
www-client/google-chrome - update to 80.0.3987.132

External References

Related Security Bulletins