CVE-2020-16048: Medium severity google angle vulnerability
In the Angle graphics library, depth pitch computations did not take into account the block size and simply multiplied the row pitch with the pixel height. This caused the load functions to use a very high depth pitch, reading past the end of the user-supplied buffer.Note: This issue only affected Windows operating systems. Other operating systems are unaffected.
Other sources
Out of bounds read in ANGLE allowed a remote attacker to obtain sensitive data via a crafted HTML page.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-16048?
CVE-2020-16048 is a vulnerability in the Angle graphics library that causes the load functions to read past the end of the user-supplied buffer.
Which software is affected by CVE-2020-16048?
Mozilla Firefox versions up to and excluding 85.0.1 and Mozilla Firefox ESR versions up to and excluding 78.7.1 are affected by CVE-2020-16048.
How severe is CVE-2020-16048?
CVE-2020-16048 has a severity rating of 9 out of 10, indicating a critical vulnerability.
How can I fix CVE-2020-16048?
To fix CVE-2020-16048, users should update to Mozilla Firefox version 85.0.1 or later, or Firefox ESR version 78.7.1 or later.
Where can I find more information about CVE-2020-16048?
More information about CVE-2020-16048 can be found in the Mozilla Bugzilla report (https://bugzilla.mozilla.org/show_bug.cgi?id=1676636) and the Mozilla Security Advisory (https://www.mozilla.org/en-US/security/advisories/mfsa2021-06/).