CVE-2020-21913 Use after free in n/a
A use-after-free vulnerability in the ICU library's pkgdata tool allows attackers to potentially execute arbitrary code or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-21913?
CVE-2020-21913 is a medium-severity use after free vulnerability in Debian Debian Linux, published on 20 Sep 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp.
Weakness: CWE-416
Which versions are affected by CVE-2020-21913?
It affects 2 products.
Linux distribution packages (17)
icu SUSE:Linux Enterprise Micro 5.1 | All versions | 65.1-150200.4.5.1 |
icu SUSE:Linux Enterprise Micro 5.2 | All versions | 65.1-150200.4.5.1 |
icu SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 65.1-150200.4.5.1 |
icu SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 65.1-150200.4.5.1 |
icu SUSE:Linux Enterprise Module for Legacy 15 SP3 | All versions | 60.2-150000.3.12.1 |
icu SUSE:Linux Enterprise Module for Legacy 15 SP4 | All versions | 60.2-150000.3.12.1 |
icu SUSE:Linux Enterprise Module for Package Hub 15 SP3 | All versions | 65.1-150200.4.5.1 |
icu SUSE:Linux Enterprise Module for Package Hub 15 SP4 | All versions | 65.1-150200.4.5.1 |
icu SUSE:Linux Enterprise Server 12 SP5 | All versions | 52.1-8.13.1 |
icu SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 52.1-8.13.1 |
icu SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 52.1-8.13.1 |
icu SUSE:Linux Enterprise Workstation Extension 12 SP5 | All versions | 52.1-8.13.1 |
icu openSUSE:Leap 15.3 | All versions | 60.2-150000.3.12.1 |
icu openSUSE:Leap 15.3 | All versions | 65.1-150200.4.5.1 |
icu openSUSE:Leap 15.4 | All versions | 60.2-150000.3.12.1 |
icu openSUSE:Leap 15.4 | All versions | 65.1-150200.4.5.1 |
icu openSUSE:Leap Micro 5.2 | All versions | 65.1-150200.4.5.1 |
Products include Debian Debian Linux, Unicode International Components for Unicode.
How do I fix CVE-2020-21913?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2020-21913 being exploited?
There is no known exploitation of CVE-2020-21913 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2020-21913, CLEANSTART-2026-AK78825, DEBIAN-CVE-2020-21913, DLA-2784-1, DSA-5014-1, GHSA-3vq4-8jw3-cwr6 and 6 more.