CVE-2020-29367 blosc2 heap-based buffer overflow
A heap-based buffer overflow in the C-Blosc2 library allows attackers to execute arbitrary code or cause denial of service via crafted compressed data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-29367?
CVE-2020-29367 is a high-severity memory corruption vulnerability in n/a, published on 27 Nov 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
blosc2.c in Blosc C-Blosc2 through 2.0.0.beta.5 has a heap-based buffer overflow when there is a lack of space to write compressed data.
Weakness: CWE-787
Which versions are affected by CVE-2020-29367?
2 open source packages ship an affected version, including blosc2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
blosc2 PyPI | All versions | 0.1.7 |
blosc2 PyPI | All versions | 0.1.7 |
Linux distribution packages (4)
blosc SUSE:Package Hub 15 SP1 | All versions | 1.20.1-bp152.4.3.1 |
blosc SUSE:Package Hub 15 SP2 | All versions | 1.20.1-bp152.4.3.1 |
blosc openSUSE:Leap 15.1 | All versions | 1.20.1-bp152.4.3.1 |
blosc openSUSE:Leap 15.2 | All versions | 1.20.1-bp152.4.3.1 |
Products include Blosc C-Blosc2.
How do I fix CVE-2020-29367?
Upgrade blosc2 to 0.1.7 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-29367 being exploited?
There is no known exploitation of CVE-2020-29367 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-8c7c-2c8j-3xfp, MGASA-2021-0051, openSUSE-SU-2020:2337-1, openSUSE-SU-2024:10655-1.