383
VMScore

CVE-2020-16012

Published: 08/01/2021 Updated: 12/01/2021
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 4.3 | Impact Score: 1.4 | Exploitability Score: 2.8
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Vulnerability Summary

Side-channel information leakage in graphics in Google Chrome before 87.0.4280.66 allowed a remote malicious user to leak cross-origin data via a crafted HTML page.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

google chrome

mozilla firefox

Vendor Advisories

Synopsis Important: firefox security update Type/Severity Security Advisory: Important Topic An update for firefox is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, ...
Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...
Synopsis Important: firefox security update Type/Severity Security Advisory: Important Topic An update for firefox is now available for Red Hat Enterprise Linux 81 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring ...
Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 82 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability ...
Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 81 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability ...
Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...
Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...
Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Important A Common Vul ...
Synopsis Important: firefox security update Type/Severity Security Advisory: Important Topic An update for firefox is now available for Red Hat Enterprise Linux 82 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring ...
Synopsis Important: firefox security update Type/Severity Security Advisory: Important Topic An update for firefox is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, ...
Synopsis Important: firefox security update Type/Severity Security Advisory: Important Topic An update for firefox is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerabili ...
When drawing a transparent image on top of an unknown cross-origin image, the Skia library `drawImage` function took a variable amount of time depending on the content of the underlying image This resulted in potential cross-origin information exposure of image content through timing side-channel attacks (CVE-2020-16012) The Mozilla Foundation Se ...
Multiple security issues were discovered in the Chromium web browser, which could result in the execution of arbitrary code, denial of service or information disclosure For the stable distribution (buster), these problems have been fixed in version 870428088-04~deb10u1 We recommend that you upgrade your chromium packages For the detailed sec ...
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information disclosure, phishing, cross-site scripting or a DNS rebinding attack For the stable distribution (buster), these problems have been fixed in version 7850esr-1~deb10u1 We recommend that you u ...
Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code or denial of service For the stable distribution (buster), these problems have been fixed in version 1:7850-1~deb10u1 We recommend that you upgrade your thunderbird packages For the detailed security status of thunderbird please refer to ...
A parsing and event loading mismatch has been found in Firefox's SVG code before 830 and could have allowed load events to fire, even after sanitization An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass the built-in sanitizer ...
Mozilla Foundation Security Advisory 2020-50 Security Vulnerabilities fixed in Firefox 83 Announced November 17, 2020 Impact high Products Firefox Fixed in Firefox 83 ...
Mozilla Foundation Security Advisory 2020-52 Security Vulnerabilities fixed in Thunderbird 785 Announced November 17, 2020 Impact high Products Thunderbird Fixed in Thunderbird 785 ...
Mozilla Foundation Security Advisory 2020-51 Security Vulnerabilities fixed in Firefox ESR 785 Announced November 17, 2020 Impact high Products Firefox ESR Fixed in Firefox ESR 785 ...
The Chrome team is delighted to announce the promotion of Chrome 87 to the Stable channel (870428066 for Windows and Linux, 870428067 for Mac) This will roll out over the coming days/weeksChrome 870428066/67 contains native support for Apple M1 devices and a number of fixes and improvements -- a list of changes is available in the&n ...

Github Repositories

PoC for CVE-2020-16012, a timing side channel in drawImage in Firefox & Chrome

This repo contains PoCs for CVE-2020-16012, a side channel vulnerability in the implementation of CanvasRenderingContext2DdrawImage() in Firefox and Chromium Read a writeup of this vulnerability on the Mozilla Attack & Defense blog Inside benchmark is code for measuring the timing of the operations involved, as well as the results of the benchmark obtained on Firefox