PT-2022-9015 · Unknown+2 · Multimon-Ng+2

Rfarley3 · Published 2022-12-19 · Updated 2024-10-09 · CVE-2020-36619

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions multimon-ng versions prior to 1.2.0

Description A critical issue affects the function add ch of the file demod flex.c. The manipulation of the argument ch leads to a format string issue.

Recommendations For versions prior to 1.2.0, upgrade to version 1.2.0 to address this issue. As a temporary workaround, consider restricting the manipulation of the ch argument in the add ch function until the upgrade is applied.

Fix

Use of Externally-Controlled Format String

Buffer Overflow

Weakness Enumeration

CWE-134

CWE-119

Related Identifiers

ALT-PU-2023-4943

ALT-PU-2024-13580

ALT-PU-2024-7197

CVE-2020-36619

OPENSUSE-SU-2022:10253-1

OPENSUSE-SU-2023:0004-1

Affected Products

Alt Linux

Debian

Multimon-Ng

References · 19

• https://github.com/EliasOenal/multimon-ng/pull/160 · Patch
• https://github.com/EliasOenal/multimon-ng/commit/e5a51c508ef952e81a6da25b43034dd1ed023c07 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2023:0004-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36619 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:10253-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-36619 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36619 · Security Note
• https://ubuntu.com/security/CVE-2020-36619 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36619 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36619 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-36619 · Vendor Advisory
• https://github.com/EliasOenal/multimon-ng/releases/tag/1.2.0 · Note
• https://t.me/cvenotify/40810 · Telegram Post
• https://t.me/cibsecurity/54870 · Telegram Post
• https://bugzilla.suse.com/1206542 · Note