Buffer Overflow Vulnerability in bsdiff4 Affects Multiple Versions
CVE-2020-15904

7.8HIGH

Key Information:

Vendor

Pypi

Status
Bsdiff4
Vendor
CVE Published:
22 July 2020

What is CVE-2020-15904?

A buffer overflow vulnerability exists in the patching routine of bsdiff4 prior to version 1.2.0. This flaw allows attackers to exploit crafted patch files to write beyond the allocated memory bounds, potentially compromising system stability and security. Users are advised to upgrade to the latest version to mitigate risks associated with this type of vulnerability.

References

https://github.com/ilanschnell/bsdiff4/commit/49a4cee2fee...
x_refsource_MISC
https://github.com/ilanschnell/bsdiff4/blob/master/CHANGE...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.