CVE-2020-29361 Integer overflow in n/a
Integer overflows in p11-kit library array allocations allow attackers to cause denial of service or potentially execute code via crafted inputs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-29361?
CVE-2020-29361 is a high-severity vulnerability in Debian Debian Linux, published on 16 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc.
Weakness: CWE-190
Which versions are affected by CVE-2020-29361?
It affects 2 products.
Linux distribution packages (27)
p11-kit SUSE:Enterprise Storage 6 | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Enterprise Storage 7 | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise High Performance Computing 15-LTSS | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise Micro 5.0 | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise Micro 5.1 | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise Module for Package Hub 15 SP2 | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise Module for Package Hub 15 SP3 | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise Server 15 SP1-BCL | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise Server 15 SP2-BCL | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise Server 15-LTSS | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise Server for SAP Applications 15 | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Manager Proxy 4.1 | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Manager Retail Branch Server 4.1 | All versions | 0.23.2-4.13.1 |
p11-kit SUSE:Manager Server 4.1 | All versions | 0.23.2-4.13.1 |
p11-kit openSUSE:Leap 15.2 | All versions | 0.23.2-lp152.7.3.1 |
p11-kit openSUSE:Leap 15.3 | All versions | 0.23.2-4.13.1 |
Products include Debian Debian Linux, P11-Kit Project P11-Kit.
How do I fix CVE-2020-29361?
Apply the vendor's patch.
Is CVE-2020-29361 being exploited?
There is no known exploitation of CVE-2020-29361 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2020-29361, DEBIAN-CVE-2020-29361, GHSA-q4r3-hm6m-mvc2, SUSE-SU-2021:4154-1, UBUNTU-CVE-2020-29361, USN-4677-2 and 3 more.