# CVEs published 2020-02-27

78 CVEs were published on February 27, 2020: 0 critical, 6 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2020-6418](https://cve.now/CVE-2020-6418.md): Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, KEV, Google Chrome)
- [CVE-2020-6386](https://cve.now/CVE-2020-6386.md): Use after free in speech in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2020-6407](https://cve.now/CVE-2020-6407.md): Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corrupt (no CVSS, Google Chrome)
- [CVE-2020-6383](https://cve.now/CVE-2020-6383.md): Type confusion in V8 in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2020-6384](https://cve.now/CVE-2020-6384.md): Use after free in WebAudio in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2020-9432](https://cve.now/CVE-2020-9432.md): openssl\_x509\_check\_host in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua\_pushboolean for certain non-boole (no CVSS)
- [CVE-2020-9433](https://cve.now/CVE-2020-9433.md): openssl\_x509\_check\_email in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua\_pushboolean for certain non-bool (no CVSS)
- [CVE-2020-9434](https://cve.now/CVE-2020-9434.md): openssl\_x509\_check\_ip\_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua\_pushboolean for certain non-boo (no CVSS)
- [CVE-2020-9428](https://cve.now/CVE-2020-9428.md): In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. (no CVSS)
- [CVE-2020-9429](https://cve.now/CVE-2020-9429.md): In Wireshark 3.2.0 to 3.2.1, the WireGuard dissector could crash. (no CVSS)
- [CVE-2020-9430](https://cve.now/CVE-2020-9430.md): In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the WiMax DLMAP dissector could crash. (no CVSS)
- [CVE-2020-9431](https://cve.now/CVE-2020-9431.md): In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. (no CVSS)
- [CVE-2018-8878](https://cve.now/CVE-2018-8878.md): Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices a (no CVSS)
- [CVE-2018-8877](https://cve.now/CVE-2018-8877.md): Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices a (no CVSS)
- [CVE-2020-3846](https://cve.now/CVE-2020-3846.md): A buffer overflow was addressed with improved size validation. (no CVSS, Apple iOS · Apple macOS +4)
- [CVE-2020-3853](https://cve.now/CVE-2020-3853.md): A type confusion issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple macOS +2)
- [CVE-2020-3854](https://cve.now/CVE-2020-3854.md): A memory corruption issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2020-3856](https://cve.now/CVE-2020-3856.md): A memory corruption issue was addressed with improved input validation. (no CVSS, Apple iOS · Apple macOS +2)
- [CVE-2020-3857](https://cve.now/CVE-2020-3857.md): A memory corruption issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple macOS +2)
- [CVE-2020-3858](https://cve.now/CVE-2020-3858.md): A memory corruption issue was addressed with improved memory handling. (no CVSS, Apple iOS)
- [CVE-2020-3860](https://cve.now/CVE-2020-3860.md): A memory corruption issue was addressed with improved input validation. (no CVSS, Apple iOS · Apple watchOS)
- [CVE-2020-3861](https://cve.now/CVE-2020-3861.md): The issue was addressed with improved permissions logic. (no CVSS, Apple iTunes for Windows)
- [CVE-2020-3862](https://cve.now/CVE-2020-3862.md): A denial of service issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple tvOS +3)
- [CVE-2020-3865](https://cve.now/CVE-2020-3865.md): Multiple memory corruption issues were addressed with improved memory handling. (no CVSS, Apple iOS · Apple tvOS +3)
- [CVE-2020-3866](https://cve.now/CVE-2020-3866.md): This was addressed with additional checks by Gatekeeper on files mounted through a network share. (no CVSS, Apple macOS)
- [CVE-2020-3867](https://cve.now/CVE-2020-3867.md): A logic issue was addressed with improved state management. (no CVSS, Apple iOS · Apple tvOS +3)
- [CVE-2020-3868](https://cve.now/CVE-2020-3868.md): Multiple memory corruption issues were addressed with improved memory handling. (no CVSS, Apple iOS · Apple tvOS +3)
- [CVE-2020-3869](https://cve.now/CVE-2020-3869.md): An issue existed in the handling of the local user's self-view. (no CVSS, Apple iOS)
- [CVE-2020-3870](https://cve.now/CVE-2020-3870.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple iOS · Apple macOS +2)
- [CVE-2020-3871](https://cve.now/CVE-2020-3871.md): A memory corruption issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2020-3872](https://cve.now/CVE-2020-3872.md): A memory initialization issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple macOS +2)
- [CVE-2020-3873](https://cve.now/CVE-2020-3873.md): This issue was addressed with improved setting propagation. (no CVSS, Apple iOS)
- [CVE-2020-3874](https://cve.now/CVE-2020-3874.md): An issued existed in the naming of screenshots. (no CVSS, Apple iOS)
- [CVE-2020-3875](https://cve.now/CVE-2020-3875.md): A validation issue was addressed with improved input sanitization. (no CVSS, Apple iOS · Apple macOS +2)
- [CVE-2020-3877](https://cve.now/CVE-2020-3877.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple macOS · Apple watchOS)
- [CVE-2020-3878](https://cve.now/CVE-2020-3878.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple iOS · Apple macOS +4)
- [CVE-2020-3825](https://cve.now/CVE-2020-3825.md): Multiple memory corruption issues were addressed with improved memory handling. (no CVSS, Apple iOS · Apple tvOS +3)
- [CVE-2020-3826](https://cve.now/CVE-2020-3826.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple iOS · Apple macOS +4)
- [CVE-2020-3827](https://cve.now/CVE-2020-3827.md): A memory corruption issue was addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2020-3828](https://cve.now/CVE-2020-3828.md): A lock screen issue allowed access to contacts on a locked device. (no CVSS, Apple iOS)
- [CVE-2020-3829](https://cve.now/CVE-2020-3829.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple iOS · Apple macOS +2)
- [CVE-2020-3830](https://cve.now/CVE-2020-3830.md): A validation issue existed in the handling of symlinks. (no CVSS, Apple macOS)
- [CVE-2020-3831](https://cve.now/CVE-2020-3831.md): A race condition was addressed with improved locking. (no CVSS, Apple iOS)
- [CVE-2020-3833](https://cve.now/CVE-2020-3833.md): An inconsistent user interface issue was addressed with improved state management. (no CVSS, Apple Safari)
- [CVE-2020-3834](https://cve.now/CVE-2020-3834.md): A memory corruption issue was addressed with improved state management. (no CVSS, Apple watchOS)
- [CVE-2020-3835](https://cve.now/CVE-2020-3835.md): A validation issue existed in the handling of symlinks. (no CVSS, Apple macOS)
- [CVE-2020-3836](https://cve.now/CVE-2020-3836.md): An access issue was addressed with improved memory management. (no CVSS, Apple iOS · Apple macOS +2)
- [CVE-2020-3837](https://cve.now/CVE-2020-3837.md): A memory corruption issue was addressed with improved memory handling. (CVSS 7.8, KEV, Apple iOS · Apple macOS +2)
- [CVE-2020-3838](https://cve.now/CVE-2020-3838.md): The issue was addressed with improved permissions logic. (no CVSS, Apple iOS · Apple macOS +2)
- [CVE-2020-3839](https://cve.now/CVE-2020-3839.md): A validation issue was addressed with improved input sanitization. (no CVSS, Apple macOS)
- [CVE-2020-3840](https://cve.now/CVE-2020-3840.md): An off by one issue existed in the handling of racoon configuration files. (no CVSS, Apple iOS · Apple macOS +1)
- [CVE-2020-3841](https://cve.now/CVE-2020-3841.md): The issue was addressed with improved UI handling. (no CVSS, Apple iOS · Apple Safari)
- [CVE-2020-3842](https://cve.now/CVE-2020-3842.md): A memory corruption issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple macOS +2)
- [CVE-2020-3843](https://cve.now/CVE-2020-3843.md): A memory corruption issue was addressed with improved input validation. (no CVSS, Apple iOS-1 · Apple watchOS-1)
- [CVE-2020-3844](https://cve.now/CVE-2020-3844.md): This issue was addressed with improved checks. (no CVSS, Apple iOS)
- [CVE-2020-3845](https://cve.now/CVE-2020-3845.md): A memory corruption issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2020-3859](https://cve.now/CVE-2020-3859.md): An inconsistent user interface issue was addressed with improved state management. (no CVSS, Apple iOS)
- [CVE-2020-7063](https://cve.now/CVE-2020-7063.md): Files added to tar with Phar::buildFromIterator have all-access permissions (CVSS 5.5, PHP Group PHP)
- [CVE-2020-7062](https://cve.now/CVE-2020-7062.md): Null Pointer Dereference in PHP Session Upload Progress (CVSS 7.5, PHP Group PHP)
- [CVE-2020-7061](https://cve.now/CVE-2020-7061.md): heap-buffer-overflow in phar\_extract\_file (CVSS 6.5, PHP Group PHP)
- [CVE-2020-5402](https://cve.now/CVE-2020-5402.md): UAA fails to check the state parameter when authenticating with external IDPs (CVSS 8.8, Cloud Foundry UAA)
- [CVE-2020-5401](https://cve.now/CVE-2020-5401.md): Cloud Foundry GoRouter is vulnerable to cache poisoning (CVSS 5.3, Cloud Foundry Routing)
- [CVE-2020-5400](https://cve.now/CVE-2020-5400.md): Cloud Controller logs environment variables from app manifests (CVSS 8.0, Cloud Foundry CAPI)
- [CVE-2015-2992](https://cve.now/CVE-2015-2992.md): Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability. (no CVSS, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2017-16900](https://cve.now/CVE-2017-16900.md): Incorrect Access Control in Hunesion i-oneNet 3.0.6042.1200 allows the local user to access other user's information which is unauthorized v (no CVSS)
- [CVE-2020-7043](https://cve.now/CVE-2020-7043.md): An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. (no CVSS)
- [CVE-2020-7042](https://cve.now/CVE-2020-7042.md): An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. (no CVSS)
- [CVE-2020-7041](https://cve.now/CVE-2020-7041.md): An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. (no CVSS)
- [CVE-2020-6864](https://cve.now/CVE-2020-6864.md): ZTE E8820V3 router product is impacted by an information leak vulnerability. (no CVSS, ZTE E8820V3)
- [CVE-2020-6863](https://cve.now/CVE-2020-6863.md): ZTE E8820V3 router product is impacted by a permission and access control vulnerability. (no CVSS, ZTE E8820V3)
- [CVE-2019-5326](https://cve.now/CVE-2019-5326.md): An administrative application user of or application user with write access to Aruba Airwave VisualRF is able to obtain code execution on th (no CVSS, AirWave Management Platform)
- [CVE-2019-5323](https://cve.now/CVE-2019-5323.md): There are command injection vulnerabilities present in the AirWave application. (no CVSS, AirWave Management Platform)
- [CVE-2019-4669](https://cve.now/CVE-2019-4669.md): IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0 (CVSS 6.3, IBM Business Automation Workflow · IBM Business Process Man…)
- [CVE-2017-6371](https://cve.now/CVE-2017-6371.md): Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string in the HTTP Referer (no CVSS)
- [CVE-2017-6363](https://cve.now/CVE-2017-6363.md): In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd\_tiff.c. (no CVSS)
- [CVE-2020-3924](https://cve.now/CVE-2020-3924.md): TONNET DVR – Firmware Injection (CVSS 6.4, TONNET DVR)
- [CVE-2020-3923](https://cve.now/CVE-2020-3923.md): TONNET DVR – Broken Access Control (CVSS 8.1, TONNET DVR)
- [CVE-2015-5686](https://cve.now/CVE-2015-5686.md): Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-02-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.