PT-2020-20626 · Libzint · Zint

Christian Hartlage · Published 2020-02-24 · Updated 2020-02-26 · CVE-2020-9385

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Zint version 2.7.1

Description A NULL Pointer Dereference issue exists in libzint because multiple + characters are mishandled in the add on function in upcean.c, when called from eanx in upcean.c during EAN barcode generation.

Recommendations For Zint version 2.7.1, consider disabling the add on function in upcean.c as a temporary workaround until a patch is available. Restrict access to the eanx function in upcean.c to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2020-9385

Affected Products

Zint

References · 4

• 🔥 https://sourceforge.net/p/zint/tickets/181 · Exploit
• https://osv.dev/vulnerability/CVE-2020-9385 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9385 · Security Note
• https://t.me/cvenotify/1197 · Telegram Post