Riskcovery

CVE-2020-27350

apt integer wraparound

State
Published
Severity
5.7 Medium
Published
Dec 10, 2020
Updated
Sep 17, 2024
Reserved
Oct 20, 2020

Read the record on cve.org

Description

APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;

Scores

CVSSScoreVectorSource
3.15.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:Lcanonical

Weaknesses

  • CWE-190 Integer Overflow or Wraparound

Affected Products

ProductVersions
aptCanonical
  • 1.2.32ubuntu0 to before 1.2.32ubuntu0.2Affected
  • 1.6.12ubuntu0 to before 1.6.12ubuntu0.2Affected
  • 2.0.2ubuntu0 to before 2.0.2ubuntu0.2Affected
  • 2.1.10ubuntu0 to before 2.1.10ubuntu0.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.