CVE-2020-14354

Katalog CVE

CVSS 3.3 · Low EPSS 0,53%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada c-ares, fedoraproject fedora. Skor CVSS 3.1 3.3 (Low) menurut NVD.

Deskripsi (NVD)

A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.

Rincian

Terbit di NVD

13 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.3 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-415: Double Free
CWE-416: Use After Free

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://c-ares.haxx.se/changelog.html release notes · advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=1866838 exploit · issue tracking · patch · advisory pihak ketiga
• https://github.com/c-ares/c-ares/commit/1cc7e83c3bdfaafbc5919c95025592d8de3a170e patch · advisory pihak ketiga
• https://packetstormsecurity.com/files/158755/GS20200804145053.txt exploit · advisory pihak ketiga · vdb entry
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLX...