CVE-2020-6389: High severity Google Chrome vulnerability

Q: What is the severity of CVE-2020-6389?

CVE-2020-6389 is classified as a high severity vulnerability due to its potential to allow an out of bounds write in the WebRTC component.

Q: How do I fix CVE-2020-6389?

To fix CVE-2020-6389, update to the latest version of Chromium browser or Google Chrome, specifically versions later than 80.0.3987.87.

Q: What systems are affected by CVE-2020-6389?

CVE-2020-6389 affects Google Chrome and Chromium versions prior to 80.0.3987.87.

Q: What are the potential impacts of CVE-2020-6389?

The potential impact of CVE-2020-6389 includes exploitation that can lead to data corruption or a possible breach of user privacy.

Q: What is the nature of the vulnerability in CVE-2020-6389?

CVE-2020-6389 is an out of bounds write vulnerability, which means it allows writing data outside the intended memory buffer.

Published Feb 10, 2020

Updated

An out of bounds write flaw was found in the WebRTC component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1042933

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

Other sources

Out of bounds write in WebRTC in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted video stream.

Affected Software

3 affected componentsFixes available

redhat/chromium-browser<80.0.3987.87

80.0.3987.87

Google Chrome<80.0.3987.87

debian/chromium

150.0.7871.100-1~deb12u1156.0.8078.73-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.73-1~deb13u1156.0.8078.47-1156.0.8078.79-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 80.0.3987.87
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Upgrade
Upgrade chromium/WebRTC (Google Chrome) to a version that resolves this vulnerability.
Fixed in 80.0.3987.87
Compensating control
If WebRTC is not required for your use case, disable or restrict WebRTC functionality at the application/browser policy level to reduce exposure to crafted video streams.

Event History

Feb 11, 2020

CVE Published

via MITRE·02:42 PM

Data Sourced

via MITRE·02:42 PM

DescriptionWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-4638

Frequently Asked Questions

What is the severity of CVE-2020-6389?