CVE-2020-16002: Use after free in PDFium
Published Oct 13, 2020
·Updated
Use after free in PDFium in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Credit
Weipeng Jiang@@Krace(Codesafe Team of Legendsec at Qi'anxin Group)
Affected Software
8 affected componentsFixes available
debian/chromium
90.0.4430.212-1~deb10u1116.0.5845.180-1~deb11u1120.0.6099.129-1~deb11u1119.0.6045.199-1~deb12u1120.0.6099.129-1~deb12u1120.0.6099.129-1
Google Chrome<86.0.4240.111
86.0.4240.111
Google Chrome<86.0.4240.111
Fedoraproject Fedora=31
Fedoraproject Fedora=32
Fedoraproject Fedora=33
openSUSE Backports SLE=15.0-sp2
Debian Debian Linux=10.0
Remediation
Patch Available
Event History
Oct 13, 2020
CVE Published
12:00 AM
Nov 3, 2020
CVE Published
via MITRE·02:21 AM
Data Sourced
via MITRE·02:21 AM
DescriptionWeakness
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
1
What is CVE-2020-16002?
CVE-2020-16002 is a vulnerability in the PDFium component of Google Chrome that allows a remote attacker to exploit heap corruption via a crafted PDF file.
2
How does CVE-2020-16002 affect Google Chrome?
CVE-2020-16002 affects Google Chrome versions prior to 86.0.4240.111.
3
How can a remote attacker exploit CVE-2020-16002?
A remote attacker can exploit CVE-2020-16002 by sending a crafted PDF file to a vulnerable instance of Google Chrome.
4
What is the severity of CVE-2020-16002?
CVE-2020-16002 has a severity rating of 8.8 (high).
5
How can I fix CVE-2020-16002?
To fix CVE-2020-16002, update Google Chrome to version 86.0.4240.111 or later.