Impact A memory corruption bug(Heap overflow) in the FreeType font rendering library.

This can be exploited by attackers to execute arbitrary code by using specially crafted fonts with embedded PNG images .

As per https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/

Google is aware of reports that an exploit for CVE-2020-15999 exists in the wild.

Patches Upgrade to 85.3.130 or higher

References - https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/ - https://www.zdnet.com/article/google-releases-chrome-security-update-to-patch-actively-exploited-zero-day/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15999 - https://magpcss.org/ceforum/viewtopic.php?f=10&t=17942

To review the CEF/Chromium patch see https://bitbucket.org/chromiumembedded/cef/commits/cd6cbe008b127990036945fb75e7c2c1594ab10d

An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashes. This is different from CVE-2020-0093.

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.

gpg-key2ps in signing-party 1.1.x and 2.x before 2.10-1 contains an unsafe shell call enabling shell injection via a User ID.

OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to getcertname in gnutls.c.

A flaw was reported in kernel TCP subsystem while calculating a packet round trip time, when a sysctl parameter (/proc/sys/net/ipv4/tcpminrttwlen) when is set wrongly. This causes an integer over flaw which can lead to a Denial Of Service (DOS) attack.

Additional Information: ----------------------- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=19fad20d15a6494f47f85d869f00b11343ee5c78

A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the remote devices country settings. This could allow the remote device to cause a denial of service (system crash) or possibly execute arbitrary code.

An insufficient policy enforcement flaw was found in the extensions component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1113558

External References:

https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop21.html

An insufficient policy enforcement flaw was found in the extensions component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1114636

External References:

https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop21.html

An insufficient policy enforcement flaw was found in the developer tools component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1059577

External References:

https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop19.html

An use after free flaw was found in the video component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1116304

External References:

https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop.html

An use after free flaw was found in the media component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1074706

External References:

https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop19.html

An use after free flaw was found in the reader mode component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1073015

External References:

https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop19.html

An use after free flaw was found in the WebAuthentication component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1082105

External References:

https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop.html

An insufficient policy enforcement flaw was found in the developer tools component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1067382

External References:

https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop19.html

An inappropriate implementation flaw was found in the external protocol handlers component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=1052093

External References:

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html

Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.143 allow remote attackers to cause a denial of service or possibly have other impact via unknown vectors.

Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.94 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

An use-after-free flaw was found in the extensions component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=603732

External References:

http://googlechromereleases.blogspot.com/2016/04/stable-channel-update28.html

Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.75 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

A critical vulnerability was found in Chrome:

Critical CVE-2016-1629: Same-origin bypass in Blink and Sandbox escape in Chrome. Credit to anonymous.

Upstream bug report:

https://code.google.com/p/chromium/issues/detail?id=583431

External Reference:

http://googlechromereleases.blogspot.com/2016/02/stable-channel-update18.html

An unspecified use-after-free flaw was found in the IndexedDB component of the Chromium browser.

Upstream bug: https://code.google.com/p/chromium/issues/detail?id=472614

External References:

http://googlechromereleases.blogspot.com/2015/07/stable-channel-update21.html

An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, possibly, execute arbitrary code with the permission of the user running the application.

An old inffast.c optimization turns out to not be optimal anymore with modern compilers, and furthermore was not compliant with the C standard, for which decrementing a pointer before its allocated memory is undefined.

External References:

https://wiki.mozilla.org/images/0/09/Zlib-report.pdf https://docs.google.com/document/d/10i1KZS5so8xDqH2rplRa2xet0tyTvvJlLbQQmZIUIKE/edit#heading=h.t13tvnx4loq7

Upstream patch:

https://github.com/madler/zlib/commit/9aaec95e82117c1cb0f9624264c3618fc380cecb

CVE assignment:

http://seclists.org/oss-sec/2016/q4/602

BZ2decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.

A security regression for CVE-2019-9636 was discovered in python's functions urllib.parse.urlsplit and urllib.parse.urlparse, introduced with commit d537ab0ff9767ef024f26246899728f0116b1ec3. No upstream python version is affected by this regression but the vulnerable commit may already have been included downstream as part of the original fix for CVE-2019-9636.

Affected python versions ignore the user/password part before @ in the netloc component of a URL, thus it still allows an attacker to exploit the vulnerability as in CVE-2019-9636. Those functions do not properly handle URLs encoded with Punycode/Internationalizing Domain Names in Applications (IDNA), which may result in a wrong domain name (specifically the netloc component of URL - user@domain:port) being returned by those functions. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

External Reference https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html

Vulnerable commit https://github.com/python/cpython/commit/d537ab0ff9767ef024f26246899728f0116b1ec3

Upstream patch https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e

A vulnerability was found in Python 2.7.x through 2.7.16 and 3.x through 3.7.2. An improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization could lead to an Information Disclosure (credentials, cookies, etc. that are cached against a given hostname) in the urllib.parse.urlsplit, urllib.parse.urlparse components. A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly.

References: https://bugs.python.org/issue36216 https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html

Uptream Patch: https://github.com/python/cpython/pull/12201

urllib in Python 2.x through 2.7.16 supports the localfile: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('localfile:///etc/passwd') call.

Last updated 25 August 2025

An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname comparisons do not consider '\0' characters, as demonstrated by a good.example.com\x00evil.example.com attack.