CVE-2020-6514
Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap corruption via a crafted SCTP stream.
Does this matter?
Lower severity and a low EPSS score (7.79%). Track it; it rarely justifies an emergency change on its own.
Description
Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap corruption via a crafted SCTP stream.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- EPSS
- 7.79% probability · 95th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- google/chrome · opensuse/backports sle · opensuse/leap · fedoraproject/fedora · debian/debian linux · canonical/ubuntu linux · apple/safari · apple/ipados · apple/iphone os · apple/tvos · apple/watchos
- Source
- chrome-cve-admin@google.com
EPSS 7.8% since 26 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00008.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00011.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00022.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00032.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00041.htmlMailing List, Third Party Advisory
- http://packetstormsecurity.com/files/158697/WebRTC-usrsctp-Incorrect-Call.htmlExploit, Third Party Advisory, VDB Entry
- https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
- https://crbug.com/1076703Exploit, Issue Tracking, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2020/07/msg00027.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/08/msg00006.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTRPPTKZ2RKVH2XGQCWNFZ7FOGQ5LLCA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYIDWCHG24ZTFD4P42D4A4WWPPA74BCG/
- https://security.gentoo.org/glsa/202007-08Third Party Advisory
- https://security.gentoo.org/glsa/202007-64Third Party Advisory
- https://security.gentoo.org/glsa/202101-30Third Party Advisory
- https://support.apple.com/kb/HT211288Third Party Advisory
- https://support.apple.com/kb/HT211290Third Party Advisory
- https://support.apple.com/kb/HT211291Third Party Advisory
- https://support.apple.com/kb/HT211292Third Party Advisory
- https://usn.ubuntu.com/4443-1/Third Party Advisory
- https://www.debian.org/security/2020/dsa-4736Third Party Advisory
- https://www.debian.org/security/2020/dsa-4740Third Party Advisory
- https://www.debian.org/security/2021/dsa-4824Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00008.htmlMailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.