CVE-2020-1752

Katalog CVE

CVSS 7.0 · High EPSS 0,53%

Kerentanan Use After Free pada gnu glibc, canonical ubuntu linux +6 lainnya. Skor CVSS 3.1 7.0 (High) menurut NVD.

Deskripsi (NVD)

A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.

Rincian

Terbit di NVD

30 April 2020

Terakhir diubah

14 Oktober 2026

Status NVD

Modified

CVSS 3.1

7.0 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1752 issue tracking · patch · advisory pihak ketiga
• https://sourceware.org/bugzilla/show_bug.cgi?id=25414 issue tracking · patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202101-20 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20200511-0005/ advisory pihak ketiga
• https://usn.ubuntu.com/4416-1/ advisory pihak ketiga
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.boo...
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.boo...
• https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=ddc650e9b3dc916eab417ce9f79e67337b05035c
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html
• https://cert-portal.siemens.com/productcert/html/ssa-831302.html