CVE-2020-11503 Memory corruption in n/a

What is CVE-2020-11503?

CVE-2020-11503 is a critical memory corruption vulnerability in n/a, published on 18 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A heap-based buffer overflow in the awarrensmtp component of Sophos XG Firewall v17.5 MR11 and older potentially allows an attacker to run arbitrary code remotely.

Weakness: CWE-787

Which versions are affected by CVE-2020-11503?

It affects 1 product.

Products include Sophos Sfos.

How do I fix CVE-2020-11503?

No fix has been published for CVE-2020-11503 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2020-11503 being exploited?

There is no known exploitation of CVE-2020-11503 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2020-12271 Sophos SFOS SQL Injection Exploited Critical 10.0
• CVE-2022-1040 Sophos Firewall Authentication Bypass Exploited Critical 9.8
• CVE-2018-16116 SQL injection in n/a High 8.8
• CVE-2018-16117 Command injection in n/a High 8.8
• CVE-2018-16118 Command injection in n/a High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m76g-2f52-hcj3.