Vulnerability Intelligence Report
apt integer wraparound
CVE-2020-27350
APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;
No Active Exploit Signals
CVSS Base Score
5.7
MEDIUM
Exploitability:1.5
Impact Score:3.8
EPSS Probability:0.37%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-190 ↗CWE-190 Integer Overflow or Wraparound
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Canonical | apt | 1.2.32ubuntu0 < 1.2.32ubuntu0.2 (affected), 1.6.12ubuntu0 < 1.6.12ubuntu0.2 (affected), 2.0.2ubuntu0 < 2.0.2ubuntu0.2 (affected), 2.1.10ubuntu0 < 2.1.10ubuntu0.1 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.373%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Canonical Ltd. · Vendor · UK |
| Reserved | 2020-10-20T00:00:00 |
| Published | 2020-12-10T04:05:18 |
| Patch Date | 2020-12-09 |
| Last Updated | 2024-09-17T04:29:18 |
Community Chatter & Buzz