CVE-2020-15977

Published: Nov 3, 2020Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Insufficient data validation in dialogs in Google Chrome on OS X prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page.

Affected (6)

Products: Google: Chrome · Debian: Debian Linux · Fedoraproject: Fedora · +1 more

Show all products

Google: Chrome · Debian: Debian Linux · Fedoraproject: Fedora · Opensuse: Backports Sle

1 product

1 product

1 product

1 product

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Google Chrome	Before 86.0.4240.75

Running on/with	Platform Versions
Apple Mac Os X	All versions

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 31
Fedoraproject Fedora	Version 32
Fedoraproject Fedora	Version 33

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Backports Sle	Version 15.0 sp2

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (16)

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html

Source: chrome-cve-admin@google.com

Mailing ListThird Party Advisory

https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html

Source: chrome-cve-admin@google.com

Release NotesVendor Advisory

https://crbug.com/1097724

Source: chrome-cve-admin@google.com

Permissions Required

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS/

Source: chrome-cve-admin@google.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE/

Source: chrome-cve-admin@google.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/

Source: chrome-cve-admin@google.com

https://security.gentoo.org/glsa/202101-30

Source: chrome-cve-admin@google.com

Third Party Advisory

https://www.debian.org/security/2021/dsa-4824

Source: chrome-cve-admin@google.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://crbug.com/1097724

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202101-30

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2021/dsa-4824

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.