Every CVE Search/ Get API key

CVE-2020-15999

Heap buffer overflow in CefSharp

9.6 CriticalIn KEVPublic exploitFix available

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

63.9%Up 59.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.6

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record
CVE-2020-15999
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-787, CWE-120
Updated
2026-11-02
CVE List 9.6

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record
CVE-2020-15999
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-120
Updated
2026-11-02
EUVDEUVD-2020-1435 9.6

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record
EUVD-2020-1435
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-pv36-h7jh-qm62 6.5

Heap buffer overflow in CefSharp

Impact

A memory corruption bug(Heap overflow) in the FreeType font rendering library.

This can be exploited by attackers to execute arbitrary code by using specially crafted fonts with embedded PNG images .

As per https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/

Google is aware of reports that an exploit for CVE-2020-15999 exists in the wild.

Patches

Upgrade to 85.3.130 or higher

References

To review the CEF/Chromium patch see https://bitbucket.org/chromiumembedded/cef/commits/cd6cbe008b127990036945fb75e7c2c1594ab10d

Record
GHSA-pv36-h7jh-qm62
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-119, CWE-787
Updated
2026-11-02
CISA KEV No score

Google Chrome FreeType Heap Buffer Overflow Vulnerability

Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.

Record
CVE-2020-15999
Weakness
CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2020-15999 9.6

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record
ALPINE-CVE-2020-15999
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-03
Show 46 moreShow less
OSVAZL-8324 9.6

CVE-2020-15999 affecting package freetype for versions less than 2.11.1-1

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record
AZL-8324
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2020-15999 9.6

CVE-2020-15999 does not affect BellSoft software

Record
BELL-CVE-2020-15999
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.6

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record
CVE-2020-15999
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-15999 9.6

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record
DEBIAN-CVE-2020-15999
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-pv36-h7jh-qm62 6.5

Heap buffer overflow in CefSharp

Impact

A memory corruption bug(Heap overflow) in the FreeType font rendering library.

This can be exploited by attackers to execute arbitrary code by using specially crafted fonts with embedded PNG images .

As per https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/

Google is aware of reports that an exploit for CVE-2020-15999 exists in the wild.

Patches

Upgrade to 85.3.130 or higher

References

To review the CEF/Chromium patch see https://bitbucket.org/chromiumembedded/cef/commits/cd6cbe008b127990036945fb75e7c2c1594ab10d

Record
GHSA-pv36-h7jh-qm62
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-119, CWE-787
Updated
2026-11-02
OSVJLSEC-2026-456 9.6

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record
JLSEC-2026-456
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Updated
2026-11-02
OSVOESA-2021-1103 8.8

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.

Security Fix(es):

Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.(CVE-2020-15969)

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.(CVE-2020-15999)

Record
OESA-2021-1103
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:4351 8.8

Red Hat Security Advisory: chromium-browser security update

Record
RHSA-2020:4351
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:4907 8.6

Red Hat Security Advisory: freetype security update

Record
RHSA-2020:4907
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2020:4949 8.6

Red Hat Security Advisory: freetype security update

Record
RHSA-2020:4949
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2020:4950 8.6

Red Hat Security Advisory: freetype security update

Record
RHSA-2020:4950
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2020:4951 8.6

Red Hat Security Advisory: freetype security update

Record
RHSA-2020:4951
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2020:4952 8.6

Red Hat Security Advisory: freetype security update

Record
RHSA-2020:4952
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2020:4952 8.6

Important: freetype security update

FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs efficiently.

Security Fix(es):

  • freetype: Heap-based buffer overflow due to integer truncation in Load_SBit_Png (CVE-2020-15999)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2020:4952
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-15999 9.6

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record
UBUNTU-CVE-2020-15999
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2020:4952 No score

Important: freetype security update

FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs efficiently.

Security Fix(es):

  • freetype: Heap-based buffer overflow due to integer truncation in Load_SBit_Png (CVE-2020-15999)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2020:4952
Updated
2026-11-02
OSVASB-A-171232105 No score

In Load_SBit_Png of pngshim.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.

Record
ASB-A-171232105
Updated
2026-11-05
OSVMGASA-2020-0389 No score

Updated freetype2 packages fix security vulnerability

A heap buffer overflow has been found in freetype2 before 2.10.4. Malformed TTF files with PNG sbit glyphs can cause a heap buffer overflow in Load_SBit_Png as libpng uses the original 32-bit values, which are saved in png_struct. If the original width and/or height are greater than 65535, the allocated buffer won't be able to fit the bitmap. (CVE-2020-15999)

Record
MGASA-2020-0389
Updated
2026-11-02
OSVopenSUSE-SU-2020:1718-1 No score

Security update for chromium

This update for chromium fixes the following issues:

  • Update to 86.0.4240.111 boo#1177936
    • CVE-2020-16000: Inappropriate implementation in Blink.
    • CVE-2020-16001: Use after free in media.
    • CVE-2020-16002: Use after free in PDFium.
    • CVE-2020-15999: Heap buffer overflow in Freetype.
    • CVE-2020-16003: Use after free in printing.
Record
openSUSE-SU-2020:1718-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1731-1 No score

Security update for chromium

This update for chromium fixes the following issues:

  • Update to 86.0.4240.111 boo#1177936
    • CVE-2020-16000: Inappropriate implementation in Blink.
    • CVE-2020-16001: Use after free in media.
    • CVE-2020-16002: Use after free in PDFium.
    • CVE-2020-15999: Heap buffer overflow in Freetype.
    • CVE-2020-16003: Use after free in printing.

This update was imported from the openSUSE:Leap:15.1:Update update project.

Record
openSUSE-SU-2020:1731-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1734-1 No score

Security update for freetype2

This update for freetype2 fixes the following issues:

  • CVE-2020-15999: fixed a heap buffer overflow found in the handling of embedded PNG bitmaps (bsc#1177914).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:1734-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1737-1 No score

Security update for chromium

This update for chromium fixes the following issues:

  • Update to 86.0.4240.111 boo#1177936
    • CVE-2020-16000: Inappropriate implementation in Blink.
    • CVE-2020-16001: Use after free in media.
    • CVE-2020-16002: Use after free in PDFium.
    • CVE-2020-15999: Heap buffer overflow in Freetype.
    • CVE-2020-16003: Use after free in printing.
Record
openSUSE-SU-2020:1737-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1744-1 No score

Security update for freetype2

This update for freetype2 fixes the following issues:

  • CVE-2020-15999: fixed a heap buffer overflow found in the handling of embedded PNG bitmaps (bsc#1177914).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:1744-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1829-1 No score

Security update for chromium, gn

This update for chromium, gn fixes the following issues:

chromium was updated to 86.0.4240.183 boo#1178375

  • CVE-2020-16004: Use after free in user interface.
  • CVE-2020-16005: Insufficient policy enforcement in ANGLE.
  • CVE-2020-16006: Inappropriate implementation in V8
  • CVE-2020-16007: Insufficient data validation in installer.
  • CVE-2020-16008: Stack buffer overflow in WebRTC.
  • CVE-2020-16009: Inappropriate implementation in V8.
  • CVE-2020-16011: Heap buffer overflow in UI on Windows.

Update to 86.0.4240.111 boo#1177936

  • CVE-2020-16000: Inappropriate implementation in Blink.

  • CVE-2020-16001: Use after free in media.

  • CVE-2020-16002: Use after free in PDFium.

  • CVE-2020-15999: Heap buffer overflow in Freetype.

  • CVE-2020-16003: Use after free in printing.

  • chromium-86-f_seal.patch: F_SEAL* definitions added for leap 15.1 and 15.2

  • Remove vdpau->vaapi bridge as it breaks a lot: (fixes welcome by someone else than me)

  • Fix cookiemonster:

Update to 86.0.4240.75 boo#1177408:

  • CVE-2020-15967: Use after free in payments.
  • CVE-2020-15968: Use after free in Blink.
  • CVE-2020-15969: Use after free in WebRTC.
  • CVE-2020-15970: Use after free in NFC.
  • CVE-2020-15971: Use after free in printing.
  • CVE-2020-15972: Use after free in audio.
  • CVE-2020-15990: Use after free in autofill.
  • CVE-2020-15991: Use after free in password manager.
  • CVE-2020-15973: Insufficient policy enforcement in extensions.
  • CVE-2020-15974: Integer overflow in Blink.
  • CVE-2020-15975: Integer overflow in SwiftShader.
  • CVE-2020-15976: Use after free in WebXR.
  • CVE-2020-6557: Inappropriate implementation in networking.
  • CVE-2020-15977: Insufficient data validation in dialogs.
  • CVE-2020-15978: Insufficient data validation in navigation.
  • CVE-2020-15979: Inappropriate implementation in V8.
  • CVE-2020-15980: Insufficient policy enforcement in Intents.
  • CVE-2020-15981: Out of bounds read in audio.
  • CVE-2020-15982: Side-channel information leakage in cache.
  • CVE-2020-15983: Insufficient data validation in webUI.
  • CVE-2020-15984: Insufficient policy enforcement in Omnibox.
  • CVE-2020-15985: Inappropriate implementation in Blink.
  • CVE-2020-15986: Integer overflow in media.
  • CVE-2020-15987: Use after free in WebRTC.
  • CVE-2020-15992: Insufficient policy enforcement in networking.
  • CVE-2020-15988: Insufficient policy enforcement in downloads.
  • CVE-2020-15989: Uninitialized Use in PDFium.

  • Update to 0.1807:

    • no upstream changelog
Record
openSUSE-SU-2020:1829-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1952-1 No score

Security update for opera

This update for opera fixes the following issues:

Opera was updated to version 72.0.3815.320

  • CHR-8177 Update chromium on desktop-stable-86-3815 to 86.0.4240.183

  • DNA-89748 ‘Manage Extensions’ dialog is displayed with preloaded extensions

  • DNA-89766 Address bar does not respond to actions

  • The update to chromium 86.0.4240.183 fixes following issues: CVE-2020-16004, CVE-2020-16005, CVE-2020-16006, CVE-2020-16007, CVE-2020-16008, CVE-2020-16009, CVE-2020-16011

  • Update to version 72.0.3815.200

    • DNA-87150 Speed Dial tile can’t be dragged to proper place
    • DNA-89632 Improve hovering over icons
    • DNA-89647 [Light mode] Wrong URL color in ‘Add Site’ section
    • DNA-89791 Typo in Spanish

  • The update to chromium 86.0.4240.111 fixes following issues: CVE-2020-16000, CVE-2020-16001, CVE-2020-16002, CVE-2020-15999, CVE-2020-16003

  • Complete Opera 72.0 changelog at: https://blogs.opera.com/desktop/changelog-for-72/

  • Update to version 71.0.3770.271

    • DNA-88353 Crash at opera::TabCyclerView::HighlightContents (content::WebContents*, bool)
    • DNA-89177 Device update request should only be called when FCM token has changed
    • DNA-89186 Handle device expired case in all server calls
    • DNA-89202 Pages are rendered in dark mode when force dark mode prefs were synced from Opera GX
    • DNA-89247 [Mac] Fullscreen video broken if sidebar is hidden
    • DNA-89298 Some elements of VPN popup are misaligned to design
    • DNA-89305 Crash after closing Downloads pop-up
Record
openSUSE-SU-2020:1952-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:2020-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.5.0 ESR (bsc#1178824)
    • CVE-2020-26951: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012: Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953: Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956: XSS through paste (manual and clipboard API)
    • CVE-2020-26958: Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959: Use-after-free in WebRequestService
    • CVE-2020-26960: Potential use-after-free in uses of nsTArray
    • CVE-2020-15999: Heap buffer overflow in freetype
    • CVE-2020-26961: DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965: Software keyboards may have remembered typed passwords
    • CVE-2020-26966: Single-word search queries were also broadcast to local network
    • CVE-2020-26968: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:2020-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:2031-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.5.0 ESR (bsc#1178824)
    • CVE-2020-26951: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012: Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953: Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956: XSS through paste (manual and clipboard API)
    • CVE-2020-26958: Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959: Use-after-free in WebRequestService
    • CVE-2020-26960: Potential use-after-free in uses of nsTArray
    • CVE-2020-15999: Heap buffer overflow in freetype
    • CVE-2020-26961: DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965: Software keyboards may have remembered typed passwords
    • CVE-2020-26966: Single-word search queries were also broadcast to local network
    • CVE-2020-26968: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:2031-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:2096-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

TODO

  • Mozilla Thunderbird 78.5.0

    • new: OpenPGP: Added option to disable attaching the public key to a signed message (bmo#1654950)
    • new: MailExtensions: 'compose_attachments' context added to Menus API (bmo#1670822)
    • new: MailExtensions: Menus API now available on displayed messages (bmo#1670825)
    • changed: MailExtensions: browser.tabs.create will now wait for 'mail-delayed-startup-finished' event (bmo#1674407)
    • fixed: OpenPGP: Support for inline PGP messages improved (bmo#1672851)
    • fixed: OpenPGP: Message security dialog showed unverified keys as unavailable (bmo#1675285)
    • fixed: Chat: New chat contact menu item did not function (bmo#1663321)
    • fixed: Various theme and usability improvements (bmo#1673861)
    • fixed: Various security fixes MFSA 2020-52 (bsc#1178894)
    • CVE-2020-26951 (bmo#1667113) Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012 (bmo#1642028) Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953 (bmo#1656741) Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956 (bmo#1666300) XSS through paste (manual and clipboard API)
    • CVE-2020-26958 (bmo#1669355) Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959 (bmo#1669466) Use-after-free in WebRequestService
    • CVE-2020-26960 (bmo#1670358) Potential use-after-free in uses of nsTArray
    • CVE-2020-15999 (bmo#1672223) Heap buffer overflow in freetype
    • CVE-2020-26961 (bmo#1672528) DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965 (bmo#1661617) Software keyboards may have remembered typed passwords
    • CVE-2020-26966 (bmo#1663571) Single-word search queries were also broadcast to local network
    • CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697, bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479, bmo#1671923) Memory safety bugs fixed in Thunderbird 78.5

  • Mozilla Thunderbird 78.4.3

    • fixed: User interface was inconsistent when switching from the default theme to the dark theme and back to the default theme (bmo#1659282)
    • fixed: Email subject would disappear when hovering over it with the mouse when using Windows 7 Classic theme (bmo#1675970)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:2096-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:2187-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

TODO

  • Mozilla Thunderbird 78.5.0

    • new: OpenPGP: Added option to disable attaching the public key to a signed message (bmo#1654950)
    • new: MailExtensions: 'compose_attachments' context added to Menus API (bmo#1670822)
    • new: MailExtensions: Menus API now available on displayed messages (bmo#1670825)
    • changed: MailExtensions: browser.tabs.create will now wait for 'mail-delayed-startup-finished' event (bmo#1674407)
    • fixed: OpenPGP: Support for inline PGP messages improved (bmo#1672851)
    • fixed: OpenPGP: Message security dialog showed unverified keys as unavailable (bmo#1675285)
    • fixed: Chat: New chat contact menu item did not function (bmo#1663321)
    • fixed: Various theme and usability improvements (bmo#1673861)
    • fixed: Various security fixes MFSA 2020-52 (bsc#1178894)
    • CVE-2020-26951 (bmo#1667113) Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012 (bmo#1642028) Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953 (bmo#1656741) Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956 (bmo#1666300) XSS through paste (manual and clipboard API)
    • CVE-2020-26958 (bmo#1669355) Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959 (bmo#1669466) Use-after-free in WebRequestService
    • CVE-2020-26960 (bmo#1670358) Potential use-after-free in uses of nsTArray
    • CVE-2020-15999 (bmo#1672223) Heap buffer overflow in freetype
    • CVE-2020-26961 (bmo#1672528) DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965 (bmo#1661617) Software keyboards may have remembered typed passwords
    • CVE-2020-26966 (bmo#1663571) Single-word search queries were also broadcast to local network
    • CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697, bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479, bmo#1671923) Memory safety bugs fixed in Thunderbird 78.5

  • Mozilla Thunderbird 78.4.3

    • fixed: User interface was inconsistent when switching from the default theme to the dark theme and back to the default theme (bmo#1659282)
    • fixed: Email subject would disappear when hovering over it with the mouse when using Windows 7 Classic theme (bmo#1675970)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:2187-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:2315-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.5.0 ESR (bsc#1178824)
    • CVE-2020-26951: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012: Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953: Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956: XSS through paste (manual and clipboard API)
    • CVE-2020-26958: Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959: Use-after-free in WebRequestService
    • CVE-2020-26960: Potential use-after-free in uses of nsTArray
    • CVE-2020-15999: Heap buffer overflow in freetype
    • CVE-2020-26961: DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965: Software keyboards may have remembered typed passwords
    • CVE-2020-26966: Single-word search queries were also broadcast to local network
    • CVE-2020-26968: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:2315-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:1134-1 No score

Security update for python-CairoSVG, python-Pillow

This update for python-CairoSVG, python-Pillow fixes the following issues:

Update to version 2.5.1.

  • Security fix: When processing SVG files, CairoSVG was using two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provided a malicious SVG, it could make CairoSVG get stuck processing the file for a very long time.
  • Fix marker positions for unclosed paths
  • Follow hint when only output_width or output_height is set
  • Handle opacity on raster images
  • Don’t crash when use tags reference unknown tags
  • Take care of the next letter when A/a is replaced by l
  • Fix misalignment in node.vertices

Updates for version 2.5.0.

  • Drop support of Python 3.5, add support of Python 3.9.
  • Add EPS export
  • Add background-color, negate-colors, and invert-images options
  • Improve support for font weights
  • Fix opacity of patterns and gradients
  • Support auto-start-reverse value for orient
  • Draw images contained in defs
  • Add Exif transposition support
  • Handle dominant-baseline
  • Support transform-origin

python-Pillow update to version 8.3.1:

  • Catch OSError when checking if fp is sys.stdout #5585 [radarhere]

  • Handle removing orientation from alternate types of EXIF data #5584 [radarhere]

  • Make Image.array take optional dtype argument #5572 [t-vi, radarhere]

  • Use snprintf instead of sprintf. CVE-2021-34552 #5567 [radarhere]

  • Limit TIFF strip size when saving with LibTIFF #5514 [kmilos]

  • Allow ICNS save on all operating systems #4526 [baletu, radarhere, newpanjing, hugovk]

  • De-zigzag JPEG's DQT when loading; deprecate convert_dict_qtables #4989 [gofr, radarhere]

  • Replaced xml.etree.ElementTree #5565 [radarhere]

  • Moved CVE image to pillow-depends #5561 [radarhere]

  • Added tag data for IFD groups #5554 [radarhere]

  • Improved ImagePalette #5552 [radarhere]

  • Add DDS saving #5402 [radarhere]

  • Improved getxmp() #5455 [radarhere]

  • Convert to float for comparison with float in IFDRational eq #5412 [radarhere]

  • Allow getexif() to access TIFF tag_v2 data #5416 [radarhere]

  • Read FITS image mode and size #5405 [radarhere]

  • Merge parallel horizontal edges in ImagingDrawPolygon #5347 [radarhere, hrdrq]

  • Use transparency behind first GIF frame and when disposing to background #5557 [radarhere, zewt]

  • Avoid unstable nature of qsort in Quant.c #5367 [radarhere]

  • Copy palette to new images in ImageOps expand #5551 [radarhere]

  • Ensure palette string matches RGB mode #5549 [radarhere]

  • Do not modify EXIF of original image instance in exif_transpose() #5547 [radarhere]

  • Fixed default numresolution for small JPEG2000 images #5540 [radarhere]

  • Added DDS BC5 reading #5501 [radarhere]

  • Raise an error if ImageDraw.textbbox is used without a TrueType font #5510 [radarhere]

  • Added ICO saving in BMP format #5513 [radarhere]

  • Ensure PNG seeks to end of previous chunk at start of load_end #5493 [radarhere]

  • Do not allow TIFF to seek to a past frame #5473 [radarhere]

  • Avoid race condition when displaying images with eog #5507 [mconst]

  • Added specific error messages when ink has incorrect number of bands #5504 [radarhere]

  • Allow converting an image to a numpy array to raise errors #5379 [radarhere]

  • Removed DPI rounding from BMP, JPEG, PNG and WMF loading #5476, #5470 [radarhere]

  • Remove spikes when drawing thin pieslices #5460 [xtsm]

  • Updated default value for SAMPLESPERPIXEL TIFF tag #5452 [radarhere]

  • Removed TIFF DPI rounding #5446 [radarhere, hugovk]

  • Include code in WebP error #5471 [radarhere]

  • Do not alter pixels outside mask when drawing text on an image with transparency #5434 [radarhere]

  • Reset handle when seeking backwards in TIFF #5443 [radarhere]

  • Replace sys.stdout with sys.stdout.buffer when saving #5437 [radarhere]

  • Fixed UNDEFINED TIFF tag of length 0 being changed in roundtrip #5426 [radarhere]

  • Fixed bug when checking FreeType2 version if it is not installed #5445 [radarhere]

  • Do not round dimensions…

Record
openSUSE-SU-2021:1134-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score

MozillaFirefox-92.0-1.2 on GA media

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10600-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10601-1 No score

MozillaThunderbird-91.1.1-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10601-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10681-1 No score

chromedriver-93.0.4577.82-1.1 on GA media

These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10681-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10770-1 No score

freetype2-devel-2.11.0-1.2 on GA media

These are all security issues fixed in the freetype2-devel-2.11.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10770-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11209-1 No score

python36-Pillow-8.3.2-1.2 on GA media

These are all security issues fixed in the python36-Pillow-8.3.2-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11209-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score

ungoogled-chromium-113.0.5672.92-1.1 on GA media

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12948-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13827-1 No score

python310-Pillow-10.3.0-1.1 on GA media

These are all security issues fixed in the python310-Pillow-10.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13827-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11261-1 No score

python313-Pillow-12.3.0-1.1 on GA media

These are all security issues fixed in the python313-Pillow-12.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11261-1
Updated
2026-11-02
OSVSUSE-SU-2020:14548-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.5.0 ESR (bsc#1178824)
    • CVE-2020-26951: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012: Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953: Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956: XSS through paste (manual and clipboard API)
    • CVE-2020-26958: Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959: Use-after-free in WebRequestService
    • CVE-2020-26960: Potential use-after-free in uses of nsTArray
    • CVE-2020-15999: Heap buffer overflow in freetype
    • CVE-2020-26961: DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965: Software keyboards may have remembered typed passwords
    • CVE-2020-26966: Single-word search queries were also broadcast to local network
    • CVE-2020-26968: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5
Record
SUSE-SU-2020:14548-1
Updated
2026-11-02
OSVSUSE-SU-2020:2995-1 No score

Security update for freetype2

This update for freetype2 fixes the following issues:

  • CVE-2020-15999: fixed a heap buffer overflow found in the handling of embedded PNG bitmaps (bsc#1177914).
Record
SUSE-SU-2020:2995-1
Updated
2026-11-02
OSVSUSE-SU-2020:2998-1 No score

Security update for freetype2

This update for freetype2 fixes the following issues:

  • CVE-2020-15999: fixed a heap buffer overflow found in the handling of embedded PNG bitmaps (bsc#1177914).
Record
SUSE-SU-2020:2998-1
Updated
2026-11-02
OSVSUSE-SU-2020:3383-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.5.0 ESR (bsc#1178824)
    • CVE-2020-26951: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012: Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953: Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956: XSS through paste (manual and clipboard API)
    • CVE-2020-26958: Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959: Use-after-free in WebRequestService
    • CVE-2020-26960: Potential use-after-free in uses of nsTArray
    • CVE-2020-15999: Heap buffer overflow in freetype
    • CVE-2020-26961: DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965: Software keyboards may have remembered typed passwords
    • CVE-2020-26966: Single-word search queries were also broadcast to local network
    • CVE-2020-26968: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5
Record
SUSE-SU-2020:3383-1
Updated
2026-11-02
OSVSUSE-SU-2020:3458-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.5.0 ESR (bsc#1178824)
    • CVE-2020-26951: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012: Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953: Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956: XSS through paste (manual and clipboard API)
    • CVE-2020-26958: Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959: Use-after-free in WebRequestService
    • CVE-2020-26960: Potential use-after-free in uses of nsTArray
    • CVE-2020-15999: Heap buffer overflow in freetype
    • CVE-2020-26961: DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965: Software keyboards may have remembered typed passwords
    • CVE-2020-26966: Single-word search queries were also broadcast to local network
    • CVE-2020-26968: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5
Record
SUSE-SU-2020:3458-1
Updated
2026-11-02
OSVSUSE-SU-2020:3528-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

TODO

  • Mozilla Thunderbird 78.5.0

    • new: OpenPGP: Added option to disable attaching the public key to a signed message (bmo#1654950)
    • new: MailExtensions: 'compose_attachments' context added to Menus API (bmo#1670822)
    • new: MailExtensions: Menus API now available on displayed messages (bmo#1670825)
    • changed: MailExtensions: browser.tabs.create will now wait for 'mail-delayed-startup-finished' event (bmo#1674407)
    • fixed: OpenPGP: Support for inline PGP messages improved (bmo#1672851)
    • fixed: OpenPGP: Message security dialog showed unverified keys as unavailable (bmo#1675285)
    • fixed: Chat: New chat contact menu item did not function (bmo#1663321)
    • fixed: Various theme and usability improvements (bmo#1673861)
    • fixed: Various security fixes MFSA 2020-52 (bsc#1178894)
    • CVE-2020-26951 (bmo#1667113) Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012 (bmo#1642028) Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953 (bmo#1656741) Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956 (bmo#1666300) XSS through paste (manual and clipboard API)
    • CVE-2020-26958 (bmo#1669355) Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959 (bmo#1669466) Use-after-free in WebRequestService
    • CVE-2020-26960 (bmo#1670358) Potential use-after-free in uses of nsTArray
    • CVE-2020-15999 (bmo#1672223) Heap buffer overflow in freetype
    • CVE-2020-26961 (bmo#1672528) DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965 (bmo#1661617) Software keyboards may have remembered typed passwords
    • CVE-2020-26966 (bmo#1663571) Single-word search queries were also broadcast to local network
    • CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697, bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479, bmo#1671923) Memory safety bugs fixed in Thunderbird 78.5

  • Mozilla Thunderbird 78.4.3

    • fixed: User interface was inconsistent when switching from the default theme to the dark theme and back to the default theme (bmo#1659282)
    • fixed: Email subject would disappear when hovering over it with the mouse when using Windows 7 Classic theme (bmo#1675970)
Record
SUSE-SU-2020:3528-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
CefSharp.Common
NuGet
 before 85.3.130
85.3.130
CefSharp.Wpf
NuGet
 before 85.3.130
85.3.130
CefSharp.WinForms
NuGet
 before 85.3.130
85.3.130
CefSharp.Wpf.HwndHost
NuGet
 before 85.3.130
85.3.130
firefox
Alpine:v3.12
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.13
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.14
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.15
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.16
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.17
 before 83.0-r0
83.0-r0
Show 206 moreShow less
Affected packages
PackageAffectedFixed
firefox
Alpine:v3.18
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.19
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.20
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.21
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.22
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.23
 before 83.0-r0
83.0-r0
firefox-esr
Alpine:v3.12
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.13
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.14
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.15
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.16
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.17
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.18
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.19
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.20
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.21
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.22
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.23
 before 78.5.0-r0
78.5.0-r0
freetype
Alpine:v3.10
 2.6.0 up to 2.10.0-r1
2.10.0-r1
freetype
Alpine:v3.11
 2.6.0 up to 2.10.1-r1
2.10.1-r1
freetype
Alpine:v3.12
 2.6.0 up to 2.10.4-r0
2.10.4-r0
freetype
Alpine:v3.13
 2.6.0 up to 2.10.4-r0
2.10.4-r0
freetype
Alpine:v3.14
 2.6.0 up to 2.10.4-r0
2.10.4-r0
freetype
Alpine:v3.15
 2.6.0 up to 2.10.4-r0
2.10.4-r0
freetype
Alpine:v3.16
 2.6.0 up to 2.10.4-r0
2.10.4-r0
freetype
Alpine:v3.17
 2.6.0 up to 2.10.4-r0
2.10.4-r0
freetype
Alpine:v3.18
 2.6.0 up to 2.10.4-r0
2.10.4-r0
freetype
Alpine:v3.19
 2.6.0 up to 2.10.4-r0
2.10.4-r0
freetype
Alpine:v3.20
 2.6.0 up to 2.10.4-r0
2.10.4-r0
freetype
Alpine:v3.21
 2.6.0 up to 2.10.4-r0
2.10.4-r0
freetype
Alpine:v3.22
 2.6.0 up to 2.10.4-r0
2.10.4-r0
freetype
Alpine:v3.23
 2.6.0 up to 2.10.4-r0
2.10.4-r0
freetype
Alpine:v3.24
 2.6.0 up to 2.10.4-r0
2.10.4-r0
freetype
Alpine:v3.9
 2.6.0 up to 2.9.1-r3
2.9.1-r3
librewolf
Alpine:v3.21
 before 83.0-r0
83.0-r0
librewolf
Alpine:v3.22
 before 83.0-r0
83.0-r0
librewolf
Alpine:v3.23
 before 83.0-r0
83.0-r0
librewolf
Alpine:v3.24
 before 83.0-r0
83.0-r0
thunderbird
Alpine:v3.16
 before 78.5.1-r0
78.5.1-r0
thunderbird
Alpine:v3.17
 before 78.5.1-r0
78.5.1-r0
thunderbird
Alpine:v3.18
 before 78.5.1-r0
78.5.1-r0
thunderbird
Alpine:v3.19
 before 78.5.1-r0
78.5.1-r0
thunderbird
Alpine:v3.20
 before 78.5.1-r0
78.5.1-r0
thunderbird
Alpine:v3.21
 before 78.5.1-r0
78.5.1-r0
thunderbird
Alpine:v3.22
 before 78.5.1-r0
78.5.1-r0
thunderbird
Alpine:v3.23
 before 78.5.1-r0
78.5.1-r0
freetype
AlmaLinux:8
 before 2.9.1-4.el8_3.1
2.9.1-4.el8_3.1
freetype-devel
AlmaLinux:8
 before 2.9.1-4.el8_3.1
2.9.1-4.el8_3.1
platform/external/freetype
Android
 8.0:0 up to 8.0:2021-01-01, plus listed versions
8.0
8.0:2021-01-01
platform/external/freetype
Android
 8.1:0 up to 8.1:2021-01-01, plus listed versions
8.1
8.1:2021-01-01
platform/external/freetype
Android
 9:0 up to 9:2021-01-01, plus listed versions
9
9:2021-01-01
platform/external/freetype
Android
 10:0 up to 10:2021-01-01, plus listed versions
10
10:2021-01-01
platform/external/freetype
Android
 11:0 up to 11:2021-01-01, plus listed versions
11
11:2021-01-01
freetype
Azure Linux:2
 before 2.11.1-1
2.11.1-1
freetype
Debian:12
 before 2.10.2+dfsg-4
2.10.2+dfsg-4
freetype
Debian:13
 before 2.10.2+dfsg-4
2.10.2+dfsg-4
freetype
Debian:14
 before 2.10.2+dfsg-4
2.10.2+dfsg-4
freetype
Debian:9
 before 2.6.3-3.2+deb9u2, plus listed versions
2.6.3-3.22.6.3-3.2+deb9u1
2.6.3-3.2+deb9u2
freetype
Debian:10
 before 2.9.1-3+deb10u2, plus listed versions
2.9.1-32.9.1-3+deb10u1
2.9.1-3+deb10u2
chromium
Debian:10
From an advisory covering 140 CVEs
 before 87.0.4280.88-0.4~deb10u1, plus listed versions
73.0.3683.75-174.0.3729.108-175.0.3770.10-175.0.3770.80-175.0.3770.90-1
Show 42 moreShow less
76.0.3809.100-176.0.3809.100-1~deb10u176.0.3809.62-176.0.3809.71-176.0.3809.87-176.0.3809.87-278.0.3904.108-178.0.3904.108-1~deb10u178.0.3904.87-178.0.3904.97-178.0.3904.97-1~deb10u179.0.3945.130-179.0.3945.130-1~deb10u179.0.3945.130-279.0.3945.56-179.0.3945.79-180.0.3987.106-180.0.3987.116-180.0.3987.122-180.0.3987.122-280.0.3987.132-180.0.3987.132-1~deb10u180.0.3987.149-180.0.3987.149-1~deb10u180.0.3987.162-180.0.3987.162-1~deb10u181.0.4044.62-181.0.4044.92-183.0.4103.106-183.0.4103.116-183.0.4103.116-1~deb10u183.0.4103.116-1~deb10u283.0.4103.116-1~deb10u383.0.4103.116-283.0.4103.116-383.0.4103.116-3.183.0.4103.83-184.0.4147.105-184.0.4147.89-187.0.4280.88-0.187.0.4280.88-0.287.0.4280.88-0.3
87.0.4280.88-0.4~deb10u1
CefSharp.Common
NuGet
 before 85.3.130, plus listed versions
31.0.0-pre133.0.033.0.233.1.0-pre0137.0.0
Show 45 moreShow less
37.0.0-pre0137.0.0-pre0237.0.137.0.237.0.339.0.039.0.0-pre0139.0.0-pre0239.0.0-pre0339.0.139.0.241.0.041.0.0-pre0141.0.143.0.043.0.0-pre0143.0.0-pre0243.0.145.0.045.0.0-pre0147.0.047.0.0-pre0147.0.147.0.247.0.347.0.449.0.049.0.0-pre0149.0.0-pre0249.0.151.0.051.0.0-pre0151.0.0-pre0253.0.053.0.0-pre0153.0.155.0.055.0.0-pre0157.0.057.0.0-pre0162.0.0-pre0162.0.0-proprietary-codecs62.0.0-proprietary-codecs263.0.063.0.0-pre01
85.3.130
CefSharp.Wpf
NuGet
 before 85.3.130, plus listed versions
1.25.2-perlun01.25.31.25.41.25.51.25.6
Show 45 moreShow less
1.25.71.25.83.29.0-pre031.0.0-pre133.0.033.0.233.1.0-pre0137.0.037.0.0-pre0137.0.0-pre0237.0.137.0.339.0.039.0.0-pre0139.0.0-pre0239.0.0-pre0339.0.139.0.241.0.041.0.0-pre0141.0.143.0.043.0.0-pre0143.0.0-pre0243.0.145.0.045.0.0-pre0147.0.047.0.0-pre0147.0.147.0.247.0.347.0.449.0.049.0.0-pre0149.0.0-pre0249.0.151.0.051.0.0-pre0151.0.0-pre0253.0.053.0.0-pre0153.0.155.0.055.0.0-pre01
85.3.130
CefSharp.WinForms
NuGet
 before 85.3.130, plus listed versions
1.25.333.0.033.0.233.1.0-pre0137.0.0
Show 45 moreShow less
37.0.0-pre0137.0.0-pre0237.0.137.0.339.0.039.0.0-pre0139.0.0-pre0239.0.0-pre0339.0.139.0.241.0.041.0.0-pre0141.0.143.0.043.0.0-pre0143.0.0-pre0243.0.145.0.045.0.0-pre0147.0.047.0.0-pre0147.0.147.0.247.0.347.0.449.0.049.0.0-pre0149.0.0-pre0249.0.151.0.051.0.0-pre0151.0.0-pre0253.0.053.0.0-pre0153.0.155.0.055.0.0-pre0157.0.057.0.0-pre0162.0.0-pre0162.0.0-proprietary-codecs62.0.0-proprietary-codecs263.0.063.0.0-pre0163.0.0-pre02
85.3.130
CefSharp.Wpf.HwndHost
NuGet
 before 85.3.130, plus listed versions
83.4.20-pre84.4.1085.3.121
85.3.130
FreeType2_jll
Julia
 before 2.10.4+0
2.10.4+0
freetype2
Mageia:7
 before 2.9.1-4.1.mga7
2.9.1-4.1.mga7
freetype2
Mageia:7
 before 2.9.1-4.1.mga7.tainted
2.9.1-4.1.mga7.tainted
firefox
openEuler:20.03-LTS
From an advisory covering 2 CVEs
 before 79.0-5.oe1
79.0-5.oe1
firefox
openEuler:20.03-LTS-SP1
From an advisory covering 2 CVEs
 before 79.0-5.oe1
79.0-5.oe1
chromium-browser
Red Hat:rhel_extras:6
From an advisory covering 5 CVEs
 before 0:86.0.4240.111-1.el6_10
0:86.0.4240.111-1.el6_10
chromium-browser-debuginfo
Red Hat:rhel_extras:6
From an advisory covering 5 CVEs
 before 0:86.0.4240.111-1.el6_10
0:86.0.4240.111-1.el6_10
freetype
Red Hat:enterprise_linux:7::client
 before 0:2.8-14.el7_9.1
0:2.8-14.el7_9.1
freetype-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:2.8-14.el7_9.1
0:2.8-14.el7_9.1
freetype-demos
Red Hat:enterprise_linux:7::client
 before 0:2.8-14.el7_9.1
0:2.8-14.el7_9.1
freetype-devel
Red Hat:enterprise_linux:7::client
 before 0:2.8-14.el7_9.1
0:2.8-14.el7_9.1
freetype-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:2.8-14.el7_9.1
0:2.8-14.el7_9.1
freetype-demos
Red Hat:enterprise_linux:7::computenode
 before 0:2.8-14.el7_9.1
0:2.8-14.el7_9.1
freetype-devel
Red Hat:enterprise_linux:7::computenode
 before 0:2.8-14.el7_9.1
0:2.8-14.el7_9.1
freetype
Red Hat:enterprise_linux:7::server
 before 0:2.8-14.el7_9.1
0:2.8-14.el7_9.1
freetype-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:2.8-14.el7_9.1
0:2.8-14.el7_9.1
freetype-devel
Red Hat:enterprise_linux:7::server
 before 0:2.8-14.el7_9.1
0:2.8-14.el7_9.1
freetype-demos
Red Hat:enterprise_linux:7::server
 before 0:2.8-14.el7_9.1
0:2.8-14.el7_9.1
freetype
Red Hat:enterprise_linux:7::workstation
 before 0:2.8-14.el7_9.1
0:2.8-14.el7_9.1
freetype-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:2.8-14.el7_9.1
0:2.8-14.el7_9.1
freetype-devel
Red Hat:enterprise_linux:7::workstation
 before 0:2.8-14.el7_9.1
0:2.8-14.el7_9.1
freetype-demos
Red Hat:enterprise_linux:7::workstation
 before 0:2.8-14.el7_9.1
0:2.8-14.el7_9.1
freetype
Red Hat:rhel_e4s:8.0::baseos
 before 0:2.9.1-4.el8_0.1
0:2.9.1-4.el8_0.1
freetype-debuginfo
Red Hat:rhel_e4s:8.0::baseos
 before 0:2.9.1-4.el8_0.1
0:2.9.1-4.el8_0.1
freetype-debugsource
Red Hat:rhel_e4s:8.0::baseos
 before 0:2.9.1-4.el8_0.1
0:2.9.1-4.el8_0.1
freetype-demos-debuginfo
Red Hat:rhel_e4s:8.0::baseos
 before 0:2.9.1-4.el8_0.1
0:2.9.1-4.el8_0.1
freetype-devel
Red Hat:rhel_e4s:8.0::baseos
 before 0:2.9.1-4.el8_0.1
0:2.9.1-4.el8_0.1
freetype
Red Hat:rhel_eus:8.1::baseos
 before 0:2.9.1-4.el8_1.1
0:2.9.1-4.el8_1.1
freetype-debuginfo
Red Hat:rhel_eus:8.1::baseos
 before 0:2.9.1-4.el8_1.1
0:2.9.1-4.el8_1.1
freetype-debugsource
Red Hat:rhel_eus:8.1::baseos
 before 0:2.9.1-4.el8_1.1
0:2.9.1-4.el8_1.1
freetype-demos-debuginfo
Red Hat:rhel_eus:8.1::baseos
 before 0:2.9.1-4.el8_1.1
0:2.9.1-4.el8_1.1
freetype-devel
Red Hat:rhel_eus:8.1::baseos
 before 0:2.9.1-4.el8_1.1
0:2.9.1-4.el8_1.1
freetype
Red Hat:rhel_eus:8.2::baseos
 before 0:2.9.1-4.el8_2.1
0:2.9.1-4.el8_2.1
freetype-debuginfo
Red Hat:rhel_eus:8.2::baseos
 before 0:2.9.1-4.el8_2.1
0:2.9.1-4.el8_2.1
freetype-debugsource
Red Hat:rhel_eus:8.2::baseos
 before 0:2.9.1-4.el8_2.1
0:2.9.1-4.el8_2.1
freetype-demos-debuginfo
Red Hat:rhel_eus:8.2::baseos
 before 0:2.9.1-4.el8_2.1
0:2.9.1-4.el8_2.1
freetype-devel
Red Hat:rhel_eus:8.2::baseos
 before 0:2.9.1-4.el8_2.1
0:2.9.1-4.el8_2.1
freetype
Red Hat:enterprise_linux:8::baseos
 before 0:2.9.1-4.el8_3.1
0:2.9.1-4.el8_3.1
freetype-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:2.9.1-4.el8_3.1
0:2.9.1-4.el8_3.1
freetype-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:2.9.1-4.el8_3.1
0:2.9.1-4.el8_3.1
freetype-demos-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:2.9.1-4.el8_3.1
0:2.9.1-4.el8_3.1
freetype-devel
Red Hat:enterprise_linux:8::baseos
 before 0:2.9.1-4.el8_3.1
0:2.9.1-4.el8_3.1
freetype
Rocky Linux:8
 before 0:2.9.1-4.el8_3.1
0:2.9.1-4.el8_3.1
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 12 CVEs
 before 78.5.0-78.105.1
78.5.0-78.105.1
freetype2
SUSE:Linux Enterprise Module for Basesystem 15 SP1
 before 2.10.1-4.8.1
2.10.1-4.8.1
freetype2
SUSE:Linux Enterprise Module for Basesystem 15 SP2
 before 2.10.1-4.8.1
2.10.1-4.8.1
ft2demos
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
 before 2.10.1-4.8.1
2.10.1-4.8.1
freetype2
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 2.10.1-4.8.1
2.10.1-4.8.1
freetype2
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 2.10.1-4.8.1
2.10.1-4.8.1
freetype2
SUSE:Linux Enterprise Server 15-LTSS
 before 2.10.1-4.8.1
2.10.1-4.8.1
freetype2
SUSE:Linux Enterprise Server for SAP Applications 15
 before 2.10.1-4.8.1
2.10.1-4.8.1
freetype2
SUSE:HPE Helion OpenStack 8
 before 2.6.3-7.18.1
2.6.3-7.18.1
ft2demos
SUSE:HPE Helion OpenStack 8
 before 2.6.3-7.18.1
2.6.3-7.18.1
freetype2
SUSE:OpenStack Cloud 7
 before 2.6.3-7.18.1
2.6.3-7.18.1
ft2demos
SUSE:OpenStack Cloud 7
 before 2.6.3-7.18.1
2.6.3-7.18.1
freetype2
SUSE:OpenStack Cloud 8
 before 2.6.3-7.18.1
2.6.3-7.18.1
ft2demos
SUSE:OpenStack Cloud 8
 before 2.6.3-7.18.1
2.6.3-7.18.1
freetype2
SUSE:OpenStack Cloud 9
 before 2.6.3-7.18.1
2.6.3-7.18.1
ft2demos
SUSE:OpenStack Cloud 9
 before 2.6.3-7.18.1
2.6.3-7.18.1
freetype2
SUSE:OpenStack Cloud Crowbar 8
 before 2.6.3-7.18.1
2.6.3-7.18.1
ft2demos
SUSE:OpenStack Cloud Crowbar 8
 before 2.6.3-7.18.1
2.6.3-7.18.1
freetype2
SUSE:OpenStack Cloud Crowbar 9
 before 2.6.3-7.18.1
2.6.3-7.18.1
ft2demos
SUSE:OpenStack Cloud Crowbar 9
 before 2.6.3-7.18.1
2.6.3-7.18.1
freetype2
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 2.6.3-7.18.1
2.6.3-7.18.1
ft2demos
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 2.6.3-7.18.1
2.6.3-7.18.1
freetype2
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 2.6.3-7.18.1
2.6.3-7.18.1
ft2demos
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 2.6.3-7.18.1
2.6.3-7.18.1
freetype2
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 2.6.3-7.18.1
2.6.3-7.18.1
ft2demos
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 2.6.3-7.18.1
2.6.3-7.18.1
freetype2
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 2.6.3-7.18.1
2.6.3-7.18.1
freetype2
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 2.6.3-7.18.1
2.6.3-7.18.1
ft2demos
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 2.6.3-7.18.1
2.6.3-7.18.1
freetype2
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 2.6.3-7.18.1
2.6.3-7.18.1
ft2demos
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 2.6.3-7.18.1
2.6.3-7.18.1
freetype2
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 2.6.3-7.18.1
2.6.3-7.18.1
ft2demos
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 2.6.3-7.18.1
2.6.3-7.18.1
freetype2
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 2.6.3-7.18.1
2.6.3-7.18.1
ft2demos
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 2.6.3-7.18.1
2.6.3-7.18.1
freetype2
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 2.6.3-7.18.1
2.6.3-7.18.1
ft2demos
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 2.6.3-7.18.1
2.6.3-7.18.1
freetype2
SUSE:Linux Enterprise Server 12 SP5
 before 2.6.3-7.18.1
2.6.3-7.18.1
ft2demos
SUSE:Linux Enterprise Server 12 SP5
 before 2.6.3-7.18.1
2.6.3-7.18.1
freetype2
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 2.6.3-7.18.1
2.6.3-7.18.1
ft2demos
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 2.6.3-7.18.1
2.6.3-7.18.1
freetype2
SUSE:Enterprise Storage 5
 before 2.6.3-7.18.1
2.6.3-7.18.1
ft2demos
SUSE:Enterprise Storage 5
 before 2.6.3-7.18.1
2.6.3-7.18.1
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
From an advisory covering 12 CVEs
 before 78.5.0-3.119.1
78.5.0-3.119.1
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
From an advisory covering 12 CVEs
 before 78.5.0-8.17.1
78.5.0-8.17.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP1
From an advisory covering 12 CVEs
 before 78.5.0-3.107.1
78.5.0-3.107.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP2
From an advisory covering 12 CVEs
 before 78.5.0-3.107.1
78.5.0-3.107.1
MozillaFirefox
SUSE:HPE Helion OpenStack 8
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:OpenStack Cloud 7
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:OpenStack Cloud 8
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:OpenStack Cloud 9
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP4-LTSS
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Enterprise Storage 5
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
freetype
Ubuntu:Pro:14.04:LTS
 before 2.5.2-1ubuntu2.8+esm2, plus listed versions
2.4.12-0ubuntu12.5.0.1-0ubuntu22.5.1-1ubuntu12.5.1-1ubuntu22.5.1-2ubuntu1
Show 11 moreShow less
2.5.2-1ubuntu12.5.2-1ubuntu22.5.2-1ubuntu2.12.5.2-1ubuntu2.22.5.2-1ubuntu2.32.5.2-1ubuntu2.42.5.2-1ubuntu2.52.5.2-1ubuntu2.62.5.2-1ubuntu2.72.5.2-1ubuntu2.82.5.2-1ubuntu2.8+esm1
2.5.2-1ubuntu2.8+esm2
chromium-browser
Ubuntu:16.04:LTS
 before 86.0.4240.198-0ubuntu0.16.04.1, plus listed versions
45.0.2454.101-0ubuntu1.120147.0.2526.73-0ubuntu1.121847.0.2526.106-0ubuntu1.122148.0.2564.82-0ubuntu1.122248.0.2564.116-0ubuntu1.1229
Show 45 moreShow less
49.0.2623.87-0ubuntu1.123249.0.2623.108-0ubuntu1.123350.0.2661.102-0ubuntu0.16.04.1.123751.0.2704.79-0ubuntu0.16.04.1.124252.0.2743.116-0ubuntu0.16.04.1.125053.0.2785.143-0ubuntu0.16.04.1.125453.0.2785.143-0ubuntu0.16.04.1.125755.0.2883.87-0ubuntu0.16.04.126356.0.2924.76-0ubuntu0.16.04.126857.0.2987.98-0ubuntu0.16.04.127658.0.3029.81-0ubuntu0.16.04.127758.0.3029.96-0ubuntu0.16.04.127958.0.3029.110-0ubuntu0.16.04.128159.0.3071.109-0ubuntu0.16.04.128959.0.3071.109-0ubuntu0.16.04.129160.0.3112.78-0ubuntu0.16.04.129360.0.3112.113-0ubuntu0.16.04.129861.0.3163.79-0ubuntu0.16.04.130061.0.3163.100-0ubuntu0.16.04.130662.0.3202.62-0ubuntu0.16.04.130862.0.3202.75-0ubuntu0.16.04.131362.0.3202.89-0ubuntu0.16.04.131562.0.3202.94-0ubuntu0.16.04.131763.0.3239.84-0ubuntu0.16.04.163.0.3239.132-0ubuntu0.16.04.164.0.3282.119-0ubuntu0.16.04.164.0.3282.140-0ubuntu0.16.04.164.0.3282.167-0ubuntu0.16.04.165.0.3325.181-0ubuntu0.16.04.166.0.3359.139-0ubuntu0.16.04.366.0.3359.181-0ubuntu0.16.04.167.0.3396.99-0ubuntu0.16.04.268.0.3440.75-0ubuntu0.16.04.168.0.3440.106-0ubuntu0.16.04.169.0.3497.81-0ubuntu0.16.04.170.0.3538.67-0ubuntu0.16.04.170.0.3538.77-0ubuntu0.16.04.170.0.3538.110-0ubuntu0.16.04.171.0.3578.80-0ubuntu0.16.04.171.0.3578.98-0ubuntu0.16.04.172.0.3626.119-0ubuntu0.16.04.172.0.3626.121-0ubuntu0.16.04.173.0.3683.75-0ubuntu0.16.04.173.0.3683.86-0ubuntu0.16.04.174.0.3729.169-0ubuntu0.16.04.1
86.0.4240.198-0ubuntu0.16.04.1
freetype
Ubuntu:16.04:LTS
 before 2.6.1-0.1ubuntu2.5, plus listed versions
2.5.2-4ubuntu22.6.1-0.1ubuntu12.6.1-0.1ubuntu22.6.1-0.1ubuntu2.12.6.1-0.1ubuntu2.22.6.1-0.1ubuntu2.32.6.1-0.1ubuntu2.4
2.6.1-0.1ubuntu2.5
android
Ubuntu:16.04:LTS
 All versions, plus listed versions
20150818-1500-0ubuntu220150818-1500-0ubuntu320160307-0742-0ubuntu320160330-0939-0ubuntu1
 None known
chromium-browser
Ubuntu:18.04:LTS
 before 86.0.4240.198-0ubuntu0.18.04.1, plus listed versions
61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1
Show 42 moreShow less
63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu166.0.3359.139-0ubuntu0.18.04.366.0.3359.181-0ubuntu0.18.04.167.0.3396.99-0ubuntu0.18.04.168.0.3440.75-0ubuntu0.18.04.168.0.3440.106-0ubuntu0.18.04.169.0.3497.81-0ubuntu0.18.04.170.0.3538.67-0ubuntu0.18.04.170.0.3538.77-0ubuntu0.18.04.170.0.3538.110-0ubuntu0.18.04.171.0.3578.80-0ubuntu0.18.04.171.0.3578.98-0ubuntu0.18.04.172.0.3626.119-0ubuntu0.18.04.172.0.3626.121-0ubuntu0.18.04.173.0.3683.75-0ubuntu0.18.04.173.0.3683.86-0ubuntu0.18.04.174.0.3729.169-0ubuntu0.18.04.175.0.3770.90-0ubuntu0.18.04.175.0.3770.142-0ubuntu0.18.04.176.0.3809.87-0ubuntu0.18.04.176.0.3809.100-0ubuntu0.18.04.177.0.3865.90-0ubuntu0.18.04.178.0.3904.70-0ubuntu0.18.04.278.0.3904.97-0ubuntu0.18.04.178.0.3904.108-0ubuntu0.18.04.179.0.3945.79-0ubuntu0.18.04.179.0.3945.130-0ubuntu0.18.04.180.0.3987.87-0ubuntu0.18.04.180.0.3987.149-0ubuntu0.18.04.180.0.3987.163-0ubuntu0.18.04.181.0.4044.122-0ubuntu0.18.04.181.0.4044.138-0ubuntu0.18.04.183.0.4103.61-0ubuntu0.18.04.184.0.4147.105-0ubuntu0.18.04.185.0.4183.83-0ubuntu0.18.04.285.0.4183.121-0ubuntu0.18.04.186.0.4240.75-0ubuntu0.18.04.1
86.0.4240.198-0ubuntu0.18.04.1
freetype
Ubuntu:18.04:LTS
 before 2.8.1-2ubuntu2.1, plus listed versions
2.8-0.2ubuntu22.8.1-0.1ubuntu22.8.1-0.1ubuntu32.8.1-2ubuntu12.8.1-2ubuntu2
2.8.1-2ubuntu2.1
freetype
Ubuntu:20.04:LTS
 before 2.10.1-2ubuntu0.1, plus listed versions
2.9.1-42.10.1-2
2.10.1-2ubuntu0.1
chromium
openSUSE:Leap 15.1
From an advisory covering 5 CVEs
 before 86.0.4240.111-lp151.2.147.1
86.0.4240.111-lp151.2.147.1
chromium
SUSE:Package Hub 15 SP1
From an advisory covering 5 CVEs
 before 86.0.4240.111-bp151.3.116.1
86.0.4240.111-bp151.3.116.1
freetype2
openSUSE:Leap 15.1
 before 2.10.1-lp151.4.6.1
2.10.1-lp151.4.6.1
ft2demos
openSUSE:Leap 15.1
 before 2.10.1-lp151.4.6.1
2.10.1-lp151.4.6.1
chromium
openSUSE:Leap 15.2
From an advisory covering 5 CVEs
 before 86.0.4240.111-lp152.2.42.1
86.0.4240.111-lp152.2.42.1
freetype2
openSUSE:Leap 15.2
 before 2.10.1-lp152.2.5.1
2.10.1-lp152.2.5.1
ft2demos
openSUSE:Leap 15.2
 before 2.10.1-lp152.2.5.1
2.10.1-lp152.2.5.1
chromium
SUSE:Package Hub 15 SP2
From an advisory covering 39 CVEs
 before 86.0.4240.183-bp152.2.26.1
86.0.4240.183-bp152.2.26.1
gn
SUSE:Package Hub 15 SP2
From an advisory covering 39 CVEs
 before 0.1807-bp152.2.3.4
0.1807-bp152.2.3.4
opera
openSUSE:Leap 15.1 NonFree
From an advisory covering 12 CVEs
 before 72.0.3815.320-lp152.2.21.1
72.0.3815.320-lp152.2.21.1
opera
openSUSE:Leap 15.2 NonFree
From an advisory covering 12 CVEs
 before 72.0.3815.320-lp152.2.21.1
72.0.3815.320-lp152.2.21.1
MozillaFirefox
openSUSE:Leap 15.2
From an advisory covering 12 CVEs
 before 78.5.0-lp152.2.30.1
78.5.0-lp152.2.30.1
MozillaFirefox
openSUSE:Leap 15.1
From an advisory covering 12 CVEs
 before 78.5.0-lp151.2.79.1
78.5.0-lp151.2.79.1
MozillaThunderbird
openSUSE:Leap 15.2
From an advisory covering 12 CVEs
 before 78.5.0-lp152.2.19.1
78.5.0-lp152.2.19.1
MozillaThunderbird
openSUSE:Leap 15.1
From an advisory covering 12 CVEs
 before 78.5.0-lp151.2.59.1
78.5.0-lp151.2.59.1
MozillaFirefox
openSUSE:Leap 15.2
From an advisory covering 12 CVEs
 before 78.5.0-lp152.2.33.1
78.5.0-lp152.2.33.1
python-CairoSVG
openSUSE:Leap 15.2
From an advisory covering 13 CVEs
 before 2.5.1-lp152.2.3.1
2.5.1-lp152.2.3.1
python-Pillow
openSUSE:Leap 15.2
From an advisory covering 13 CVEs
 before 8.3.1-lp152.5.3.1
8.3.1-lp152.5.3.1
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 661 CVEs
 before 92.0-1.2
92.0-1.2
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 394 CVEs
 before 91.1.1-1.1
91.1.1-1.1
chromium
openSUSE:Tumbleweed
From an advisory covering 1081 CVEs
 before 93.0.4577.82-1.1
93.0.4577.82-1.1
freetype2
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 2.11.0-1.2
2.11.0-1.2
python-Pillow
openSUSE:Tumbleweed
From an advisory covering 17 CVEs
 before 8.3.2-1.2
8.3.2-1.2
chromium
openSUSE:Tumbleweed
From an advisory covering 2310 CVEs
 before 113.0.5672.92-1.1
113.0.5672.92-1.1
python-Pillow
openSUSE:Tumbleweed
From an advisory covering 18 CVEs
 before 10.3.0-1.1
10.3.0-1.1
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 1860 CVEs
 before 128.5.1-1.1
128.5.1-1.1
python-Pillow
openSUSE:Tumbleweed
From an advisory covering 24 CVEs
 before 12.3.0-1.1
12.3.0-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHuboxfemale/CVE-2020-159992020-11-04
PoC in GitHubMarmeus/CVE-2020-159992020-12-30
PoC in GitHubmaarlo/CVE-2020-159992020-12-30

History

History
RecordedChangedSources
affectedOSV
exploitation
affected, exploitsOSV
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-15999 is a critical vulnerability (CVSS 9.6) in Freetype, published October 20, 2020. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 63.9%, the 99th percentile. Fixed in CefSharp.Common 85.3.130.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 128 versions, 4,170 references and the rest of 1 source description. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 3 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open