CVE-2020-6398 — Use of Uninitialized Resource in Google Chrome

CWE-908 — Use of Uninitialized Resource10 documents8 sources

Severity

8.8HIGHNVD

EPSS

2.2%

top 15.56%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Chromium Debian Linux +5 more

Timeline

PublishedFeb 11

Latest updateMay 24

Description

Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5google/chromeunspecified — 80.0.3987.87

▶NVDgoogle/chrome< 80.0.3987.87

▶Debianchromium/chromium< 80.0.3987.106-1+3

▶NVDopensuse/backports_sle15.0

▶NVDredhat/enterprise_linux_server6.0

Also affects: Debian Linux 10.0, 9.0, Fedora 30, 31

Patches

Patch: crbug.com ↗Patch: crbug.com ↗

🔴Vulnerability Details

GHSA

GHSA-wgcr-4fm9-rf2f: Use of uninitialized data in PDFium in Google Chrome prior to 80↗2022-05-24

▶

CVEList

CVE-2020-6398: Use of uninitialized data in PDFium in Google Chrome prior to 80↗2020-02-11

▶

OSV

CVE-2020-6398: Use of uninitialized data in PDFium in Google Chrome prior to 80↗2020-02-11

▶

📋Vendor Advisories

Chrome

Stable Channel Update for Desktop: CVE-2020-6398↗2020-02-04

▶

Red Hat

chromium-browser: Uninitialized use in PDFium↗2020-02-04

▶

Debian

CVE-2020-6398: chromium - Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allow...↗2020

▶

💬Community

Bugzilla

CVE-2020-6381 CVE-2020-6382 CVE-2020-6385 CVE-2020-6387 CVE-2020-6388 CVE-2020-6389 CVE-2020-6390 CVE-2020-6391 CVE-2020-6392 CVE-2020-6393 CVE-2020-6394 CVE-2020-6395 CVE-2020-6396 CVE-2020-6397 CVE-↗2020-02-11

▶

Bugzilla

▶

Bugzilla

CVE-2020-6398 chromium-browser: Uninitialized use in PDFium↗2020-02-10

▶