Google Earth vulnerabilities

4 CVEs affecting Google Earth, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-8896, published 2020-05-04.

More from Google.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2006-7157, published 2007-03-07. High severity, CVSS 7.1. EPSS: 7.5% chance of exploitation in the next 30 days. Buffer overflow in Google Earth v4.0.2091 (beta) allows remote user-assisted attackers to cause a denial of service (crash) via a KML or KMZ file with a long href element.
• CVE-2010-3134, published 2010-08-26. High severity, CVSS 9.3. EPSS: 3.8% chance of exploitation in the next 30 days. Untrusted search path vulnerability in Google Earth 5.1.3535.3218 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse…
• CVE-2020-8896, published 2020-05-04. Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days. A Buffer Overflow vulnerability in the khcrypt implementation in Google Earth Pro versions up to and including 7.3.2 allows an attacker to perform a Man-in-the-Middle attack using a specially crafted…
• CVE-2020-8895, published 2020-04-21. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Untrusted Search Path vulnerability in the windows installer of Google Earth Pro versions prior to 7.3.3 allows an attacker to insert malicious local files to execute unauthenticated remote code on…