First published: Tue Oct 13 2020(Updated: )
Use after free in PDFium in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Credit: Weipeng Jiang @Krace Codesafe Team of Legendsec at Qi'anxin Group chrome-cve-admin@google.com
Affected Software | Affected Version | How to fix |
---|---|---|
debian/chromium | 90.0.4430.212-1~deb10u1 116.0.5845.180-1~deb11u1 120.0.6099.129-1~deb11u1 119.0.6045.199-1~deb12u1 120.0.6099.129-1~deb12u1 120.0.6099.129-1 | |
Google Chrome | <86.0.4240.111 | 86.0.4240.111 |
Google Chrome | <86.0.4240.111 | |
Fedoraproject Fedora | =31 | |
Fedoraproject Fedora | =32 | |
Fedoraproject Fedora | =33 | |
openSUSE Backports | =15.0-sp2 | |
Debian GNU/Linux | =10.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Found alongside the following vulnerabilities)
CVE-2020-16002 is a vulnerability in the PDFium component of Google Chrome that allows a remote attacker to exploit heap corruption via a crafted PDF file.
CVE-2020-16002 affects Google Chrome versions prior to 86.0.4240.111.
A remote attacker can exploit CVE-2020-16002 by sending a crafted PDF file to a vulnerable instance of Google Chrome.
CVE-2020-16002 has a severity rating of 8.8 (high).
To fix CVE-2020-16002, update Google Chrome to version 86.0.4240.111 or later.