Vulnerability Details : CVE-2019-13720
Public exploit exists!
Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Vulnerability category: Memory Corruption
Products affected by CVE-2019-13720
- cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
CVE-2019-13720 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Google Chrome WebAudio Use-After-Free Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Google Chrome WebAudio contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2019-13720
Added on
2022-05-23
Action due date
2022-06-13
Exploit prediction scoring system (EPSS) score for CVE-2019-13720
97.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-13720
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2025-02-03 |
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2019-13720
-
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2019-13720
-
http://packetstormsecurity.com/files/167066/Google-Chrome-78.0.3904.70-Remote-Code-Execution.html
Google Chrome 78.0.3904.70 Remote Code Execution ≈ Packet StormExploit;Third Party Advisory;VDB Entry
-
https://security.gentoo.org/glsa/202004-04
Qt WebEngine: Arbitrary code execution (GLSA 202004-04) — Gentoo securityThird Party Advisory
-
https://crbug.com/1019226
Inloggen - Google AccountsPermissions Required
-
https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_31.html
Chrome Releases: Stable Channel Update for DesktopVendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00022.html
[security-announce] openSUSE-SU-2019:2664-1: important: Security updateMailing List;Third Party Advisory
Jump to