Heap-based buffer overflow in FreeType - CVE-2020-15999

Vulnerability identifier: #VU47741

CSH Severity: Critical

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-15999

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in freetype library when processing TTF files. A remote attacker can pass specially crafted TTF file with PNG sbit glyphs to the application, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, this vulnerability is being actively exploited in the wild.

FreeType
Arch Linux
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Slackware Linux
Ubuntu
SUSE Linux
Opensuse
openEuler
Fedora
Chrome OS
Isolation Segment
Ansible Automation Platform
VMware Tanzu Application Service for VMs
Tanzu Greenplum for Kubernetes
IBM Security Privileged Identity Manager
Data Computing Appliance (DCA)
freetype (Debian package)
freetype (Alpine package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
firefox (Alpine package)
firefox-esr (Alpine package)
chromium (Debian package)
thunderbird (Alpine package)
chromium-browser (Red Hat package)
libfreetype6 (Ubuntu package)
freetype (Red Hat package)
freetype
freetype-debuginfo
freetype-debugsource
freetype-devel
freetype-help
firefox
firefox-debugsource
firefox-debuginfo
www-client/opera
www-client/opera-beta
www-client/chromium
www-client/google-chrome
VMware Tanzu Operations Manager
Red Hat OpenShift Container Platform
Mozilla Thunderbird
Mozilla Firefox
Firefox ESR
Google Chrome
Firefox for Android

Install updates from vendor's website.

FreeType - update to 2.10.4
Isolation Segment - addressed in versions 2.7.27, 2.8.21, 2.9.15, 2.10.7
Tanzu Greenplum for Kubernetes - update to 2.0.0
Ansible Automation Platform - update to 1.2.4
freetype (Debian package) - update to 2.9.1-3+deb10u2
freetype (Alpine package) - update to 2.10.4-r0
VMware Tanzu Application Service for VMs - addressed in versions 2.7.28, 2.8.22, 2.9.16, 2.10.8
VMware Tanzu Operations Manager - addressed in versions 2.7.25, 2.9.13, 2.10.3
Red Hat OpenShift Container Platform - addressed in versions 4.5.20, 4.5.21
Mozilla Thunderbird - update to 78.5.0
Mozilla Firefox - update to 83.0
Firefox ESR - update to 78.5.0
firefox-esr (Alpine package) - update to 78.5.0-r0
chromium (Debian package) - update to 87.0.4280.88-0.4~deb10u1
thunderbird (Alpine package) - update to 78.5.1-r0
chromium-browser (Red Hat package) - update to 86.0.4240.111-1.el6_10
Firefox for Android - update to 83.0.0
libfreetype6 (Ubuntu package) - addressed in versions 2.5.2-1ubuntu2.8+esm2, 2.6.1-0.1ubuntu2.5, 2.8.1-2ubuntu2.1, 2.10.1-2ubuntu0.1
freetype (Red Hat package) - addressed in versions 2.8-14.el7_9, 2.9.1-4.el8_0.1, 2.9.1-4.el8_1.1, 2.9.1-4.el8_2.1, 2.9.1-4.el8_3.1
freetype - addressed in versions 2.10.0-4.fc31, 2.10.4-1.fc32, 2.10.4-1.fc33
freetype-debuginfo - update to 2.10.2-2
freetype-debugsource - update to 2.10.2-2
freetype-devel - update to 2.10.2-2
freetype-help - update to 2.10.2-2
freetype - update to 2.10.2-2
freetype - update to 2.12.1-3
Data Computing Appliance (DCA) - update to 4.3.0.0
firefox - update to 62.0.3-8
firefox-debugsource - update to 62.0.3-8
firefox-debuginfo - update to 62.0.3-8
www-client/opera - update to 73.0.3856.284
www-client/opera-beta - update to 73.0.3856.284
Google Chrome - update to 86.0.4240.111
Chrome OS - update to 86.0.4240.112
www-client/chromium - update to 86.0.4240.193
www-client/google-chrome - update to 86.0.4240.193

• Exploit #6649 - CVE (A collection of proof-of-concept exploit scripts written by the STAR Labs team for various CVEs that they discovered or found by others.) (August 23, 2021)
• Exploit #4987 - CVE-2020-15999 (Repositorio con un script encargado de explotar la vulnerabilidad CVE-2020-15999) (January 3, 2021)
• Exploit #4982 - CVE-2020-15999 (Todos los materiales necesarios para la PoC en Chrome y ftview) (January 3, 2021)
• Exploit #4776 - CVE-2020-15999 (CVE-2020-15999) (November 3, 2020)

• http://git.savannah.nongnu.org/cgit/freetype/freetype2.git/commit/?id=a3bab162b2ae616074c8877a04556932998aeacd
• https://savannah.nongnu.org/bugs/?59308

• Remote code execution in FreeType library
• Arch Linux update for lib32-freetype2
• Arch Linux update for freetype2
• Slackware Linux update for freetype
• Multiple vulnerabilities in Google Chrome
• Heap-based buffer overflow in freetype (Alpine package)
• Gentoo update for FreeType
• Debian update for freetype
• OpenSUSE Linux update for chromium
• OpenSUSE Linux update for freetype2
• OpenSUSE Linux update for chromium
• OpenSUSE Linux update for chromium
• OpenSUSE Linux update for freetype2
• Red Hat Enterprise Linux 6 Supplementary update for chromium-browser
• Red Hat Enterprise Linux 7 update for freetype
• OpenSUSE Linux update for chromium, gn
• Red Hat Enterprise Linux 8 update for freetype
• Red Hat Enterprise Linux 8 update for freetype
• Red Hat Enterprise Linux 8 update for freetype
• Red Hat Enterprise Linux 8 update for freetype
• Multiple vulnerabilities in Mozilla Firefox and Firefox ESR
• Multiple vulnerabilities in Mozilla Thunderbird
• Multiple vulnerabilities in Firefox for Android
• Arch Linux update for firefox
• Remote code execution in VMware Products
• Multiple vulnerabilities in Red Hat OpenShift Container Platform
• Heap-based buffer overflow in firefox-esr (Alpine package)
• Heap-based buffer overflow in firefox (Alpine package)
• Multiple vulnerabilities in Red Hat OpenShift Container Platform
• Gentoo update for Mozilla Thunderbird
• Heap-based buffer overflow in thunderbird (Alpine package)
• Debian update for chromium
• Multiple vulnerabilities in Google ChromeOS
• Multiple vulnerabilities in IBM Security Privileged Identity Manager
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 1.2
• Gentoo update for Opera
• openEuler 20.03 LTS update for freetype
• openEuler update for firefox
• Amazon Linux AMI update for freetype
• Ubuntu update for freetype
• Ubuntu update for freetype
• Gentoo update for Chromium, Google Chrome
• Fedora 32 update for freetype
• Fedora 33 update for freetype
• Fedora 31 update for freetype