Denial of Service (DoS) Affecting chromium package, versions [,48.0.2564.97)


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
1.77% (89th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UNMANAGED-CHROMIUM-2410769
  • published26 Jan 2022
  • disclosed6 Dec 2015
  • creditUnknown

Introduced: 6 Dec 2015

CVE-2015-6781  (opens in a new tab)
CWE-189  (opens in a new tab)

How to fix?

Upgrade chromium to version 48.0.2564.97 or higher.

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS). Integer overflow in the FontData::Bound function in data/font_data.cc in Google sfntly, as used in Google Chrome before 47.0.2526.73, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted offset or length value within font data in an SFNT container.

CVSS Base Scores

version 3.1