CVE-2020-6405: SQL Injection

Q: What is the severity of CVE-2020-6405?

CVE-2020-6405 is classified as a high severity vulnerability due to potential exploitation leading to information disclosure.

Q: How do I fix CVE-2020-6405?

To fix CVE-2020-6405, update the Chromium browser and SQLite to the latest versions as specified in the vendor's remediation guidance.

Q: What versions are affected by CVE-2020-6405?

CVE-2020-6405 affects Chromium browser versions prior to 80.0.3987.87 and SQLite versions prior to 3.31.0.

Q: What type of vulnerability is CVE-2020-6405?

CVE-2020-6405 is an out-of-bounds read vulnerability found in the SQLite component of the Chromium browser.

Q: Can CVE-2020-6405 be exploited remotely?

Yes, CVE-2020-6405 can potentially be exploited remotely, allowing attackers to obtain sensitive information.

Published Feb 10, 2020

Updated

An out of bounds read flaw was found in the SQLite component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1042145

External References:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

Other sources

Out of bounds read in SQLite in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

Affected Software

4 affected componentsFixes available

debian/chromium

90.0.4430.212-1~deb10u1116.0.5845.180-1~deb11u1120.0.6099.129-1~deb11u1119.0.6045.199-1~deb12u1120.0.6099.129-1~deb12u1120.0.6099.129-1

redhat/chromium-browser<80.0.3987.87

80.0.3987.87

redhat/sqlite<3.31.0

3.31.0

Google Chrome<80.0.3987.87

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 90.0.4430.212-1~deb10u1Fixed in 116.0.5845.180-1~deb11u1Fixed in 120.0.6099.129-1~deb11u1Fixed in 119.0.6045.199-1~deb12u1Fixed in 120.0.6099.129-1~deb12u1Fixed in 120.0.6099.129-1
Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 80.0.3987.87
Upgrade
Upgrade redhat/sqlite to a version that resolves this vulnerability.
Fixed in 3.31.0
Upgrade
Upgrade Chromium browser (SQLite component) to a version that resolves this vulnerability.
Fixed in 80.0.3987.87
Compensating control
Mitigate exposure by not visiting untrusted pages until Chromium is updated, since the issue is exploitable via a crafted HTML page.

Event History

Feb 11, 2020

CVE Published

via MITRE·02:42 PM

Data Sourced

via MITRE·02:42 PM

DescriptionWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2020-6405?

CVE-2020-6405 is classified as a high severity vulnerability due to potential exploitation leading to information disclosure.

How do I fix CVE-2020-6405?

To fix CVE-2020-6405, update the Chromium browser and SQLite to the latest versions as specified in the vendor's remediation guidance.

What versions are affected by CVE-2020-6405?