PT-2020-7011 · Gnu+5 · Gsl+5

Patrick Alken + 1 · Published 2020-12-04 · Updated 2024-12-07 · CVE-2020-35357

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GSL (GNU Scientific Library) versions 2.5 and 2.6

Description A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL. Processing a maliciously crafted input data for gsl stats quantile from sorted data of the library may lead to unexpected application termination or arbitrary code execution. The issue is related to a buffer copying vulnerability without input validation, which can be exploited by a remote attacker to cause a denial of service.

Recommendations For GSL (GNU Scientific Library) versions 2.5 and 2.6, consider disabling the gsl stats quantile from sorted data function until a patch is available to prevent potential exploitation. Restrict access to the Statistics Library to minimize the risk of arbitrary code execution. Avoid using the gsl stats quantile from sorted data function with untrusted input data until the issue is resolved.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

ALT-PU-2020-4217

ALT-PU-2021-4843

ALT-PU-2024-6153

AZL-43711

AZL-45111

BDU:2025-00971

CVE-2020-35357

DLA-3576-1

DLA-3985-1

OPENSUSE-SU-2023_3527-1

OPENSUSE-SU-2023_3858-1

SUSE-SU-2023:3527-1

SUSE-SU-2023:3858-1

SUSE-SU-2023:4051-1

SUSE-SU-2023_3858-1

SUSE-SU-2023_4051-1

USN-6472-1

Affected Products

Alt Linux

Astra Linux

Gsl

Linuxmint

Suse

Ubuntu

References · 33

• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0319SE17 · Vendor Advisory
• https://savannah.gnu.org/bugs/?59624 · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-35357 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3576-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35357 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-0422SE65 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:3858-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-35357 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:3527-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0114SE18MD · Vendor Advisory
• https://osv.dev/vulnerability/USN-6472-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-35357 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-45111 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:4051-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3985-1 · Vendor Advisory