CVE-2020-8794

Katalog CVE

CVSS 9.8 · Critical EPSS 88,9%

Kerentanan Out-of-bounds Read pada opensmtpd, canonical ubuntu linux +2 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.

Rincian

Terbit di NVD

25 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

88,9% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://usn.ubuntu.com/4294-1/ patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/156633/OpenSMTPD-Out-Of-Bounds-Read-Local-Privilege-Escalation.html exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2020/Feb/32 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2020/02/26/1 exploit · mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2020/03/01/1 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2020/03/01/2 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/05/04/7 exploit · mailing list · advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4634 advisory pihak ketiga
• https://www.openbsd.org/security.html advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2020/02/24/5 exploit · mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPH4QU4DNVHA7...