Lucene search

K
amazonAmazonALAS-2023-1851
HistorySep 27, 2023 - 10:15 p.m.

Medium: gsl

2023-09-2722:15:00
alas.aws.amazon.com
6
buffer overflow
gnu scientific library
cve-2020-35357
update
red hat
mitre
unix

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

31.4%

Issue Overview:

A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution. (CVE-2020-35357)

Affected Packages:

gsl

Issue Correction:
Run yum update gsl to update your system.

New Packages:

i686:  
    gsl-debuginfo-1.13-4.4.amzn1.i686  
    gsl-1.13-4.4.amzn1.i686  
    gsl-static-1.13-4.4.amzn1.i686  
    gsl-devel-1.13-4.4.amzn1.i686  
  
src:  
    gsl-1.13-4.4.amzn1.src  
  
x86_64:  
    gsl-debuginfo-1.13-4.4.amzn1.x86_64  
    gsl-static-1.13-4.4.amzn1.x86_64  
    gsl-devel-1.13-4.4.amzn1.x86_64  
    gsl-1.13-4.4.amzn1.x86_64  

Additional References

Red Hat: CVE-2020-35357

Mitre: CVE-2020-35357

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

31.4%