Microsoft security update for CVE-2020-8927
🔗 CVE IDs covered (1)
📋 Microsoft's advisory
EchelonGraph does not copy Microsoft's advisory page: its FAQ and remediation text are not shown here. Read the advisory on https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-8927. This page also shows what EchelonGraph holds for CVE-2020-8927, with the description from its CVE record, which the CVE Numbering Authority that assigned the CVE wrote: for a CVE Microsoft assigned, often in the words of Microsoft's own advisory.
🎯 Affected products10
- .NET 5.0
- .NET Core 3.1
- Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
- Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)
- Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)
- Microsoft Visual Studio 2022 version 17.0
- Microsoft Visual Studio 2022 version 17.1
- PowerShell 7.0
- PowerShell 7.1
- PowerShell 7.2
✅ Updates Microsoft lists: 10 updates
10 rows: one per KB article or update, update type and fixed build. Their details are on Microsoft's advisory.
| KB article | Update | Fixed build |
|---|---|---|
| — | Security Update | 3.1.23 |
| — | Security Update | 5.0.15 |
| — | Security Update | 16.7.26 |
| — | Security Update | 16.9.18 |
| — | Security Update | 16.11.11 |
| — | Security Update | 17.0.7 |
| — | Security Update | 7.2.2 |
| — | Security Update | 7.1.6 |
| — | Security Update | 7.0.9 |
| — | Security Update | 17.1.4 |
🧭 EchelonGraph on CVE-2020-8927
- EchelonGraph score
- 6.5 MEDIUM
- CISA KEV
- Not listed
- Fix status
- A fix is available — apply it.
Description from the CVE record (CVE.org), as published by its numbering authority
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.
Published by Google LLC, the CVE Numbering Authority that assigned CVE-2020-8927, in its CVE record at CVE.org; reused under the CVE Program's Terms of Use (its licence and MITRE's copyright notice are in our Terms of Service).
🔗 References (15)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-8927
- patchhttps://dotnet.microsoft.com/download/dotnet-core/3.1
- referencehttps://github.com/dotnet/announcements/issues/211
- patchhttps://dotnet.microsoft.com/download/dotnet/5.0
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2019 version 16.7
- referencehttps://docs.microsoft.com/en-us/visualstudio/releases/2019/release-notes-v16.7
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2019 version 16.9
- referencehttps://docs.microsoft.com/en-us/visualstudio/releases/2019/release-notes-v16.9
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2019 version 16.11
- referencehttps://docs.microsoft.com/en-us/visualstudio/releases/2019/release-notes-v16.11
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.0
- referencehttps://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes
- patchhttps://github.com/PowerShell/PowerShell#get-powershell
- referencehttps://github.com/PowerShell/Announcements/issues/30
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.1