PT-2020-6218 · Libbsd+4 · Libbsd+4

Daniel Hodson · Published 2020-01-08 · Updated 2023-06-13 · CVE-2019-20367

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions libbsd versions prior to 0.10.0

Description The issue is related to an out-of-bounds read in the nlist.c file of the libbsd library. This occurs during a comparison for a symbol name from the string table (strtab). The exploitation of this issue may allow a remote attacker to access confidential data and cause a denial of service.

Recommendations For libbsd versions prior to 0.10.0, update to version 0.10.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data handled by the libbsd library until the update is applied.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2020-2720

ALT-PU-2023-1981

BDU:2021-03611

CVE-2019-20367

DLA-2566-1

MGASA-2020-0061

OPENSUSE-SU-2020:0679-1

OPENSUSE-SU-2020_0679-1

SUSE-SU-2020:1298-1

SUSE-SU-2020_1298-1

USN-4243-1

Affected Products

Alt Linux

Astra Linux

Suse

Ubuntu

Libbsd

References · 39

• 🔥 https://gitlab.freedesktop.org/libbsd/libbsd/commit/9d917aad37778a9f4a96ba358415f077f3f36f3b · Exploit
• https://ubuntu.com/security/CVE-2019-20367 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4243-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0114SE47 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03611 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-20367 · Vendor Advisory
• https://lists.freedesktop.org/archives/libbsd/2019-August/000229.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0061 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2090 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0061.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-20367 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-20367 · Security Note
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20367 · Security Note