CVE-2019-20367 Information disclosure in n/a
An out-of-bounds read in libbsd allows attackers to disclose sensitive memory contents via crafted symbol table comparisons.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-20367?
CVE-2019-20367 is a critical vulnerability in Canonical Ubuntu Linux, published on 8 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).
Weakness: CWE-125
Which versions are affected by CVE-2019-20367?
It affects 4 products.
Linux distribution packages (2)
libbsd SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 0.8.7-3.3.17 |
libbsd openSUSE:Leap 15.1 | All versions | 0.8.7-lp151.3.3.1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Freedesktop Libbsd, Opensuse Leap.
How do I fix CVE-2019-20367?
Upgrade to a fixed version.
Is CVE-2019-20367 being exploited?
There is no known exploitation of CVE-2019-20367 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2019-20367, DEBIAN-CVE-2019-20367, DLA-2566-1, GHSA-mc9f-fv52-p544, MGASA-2020-0061, SUSE-SU-2020:1298-1 and 2 more.