Skip to content

Use after free in CefSharp

High severity GitHub Reviewed Published Nov 27, 2020 in cefsharp/CefSharp • Updated Feb 1, 2023

Package

nuget CefSharp.Common (NuGet)

Affected versions

< 86.0.241

Patched versions

86.0.241
nuget CefSharp.WinForms (NuGet)
< 86.0.241
86.0.241
nuget CefSharp.Wpf (NuGet)
< 86.0.241
86.0.241
nuget CefSharp.Wpf.HwndHost (NuGet)
< 86.0.241
86.0.241

Description

CVE-2020-16017: Use after free in site isolation

Google is aware of reports that exploits for CVE-2020-16013 and CVE-2020-16017 exist in the wild.

There is currently little to no public information on the issue other than it has been flagged as High severity.

References

@amaitland amaitland published to cefsharp/CefSharp Nov 27, 2020
Reviewed Nov 27, 2020
Published to the GitHub Advisory Database Nov 27, 2020
Published by the National Vulnerability Database Jan 8, 2021
Last updated Feb 1, 2023

Severity

High

EPSS score

Exploit Prediction Scoring System (EPSS)

This score estimates the probability of this vulnerability being exploited within the next 30 days. Data provided by FIRST.
(96th percentile)

Weaknesses

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer. Learn more on MITRE.

CVE ID

CVE-2020-16017

GHSA ID

GHSA-gvqv-779r-4jgp

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.