CVE-2020-28163

2023-04-1600:15:07

Debian Security Bug Tracker

security-tracker.debian.org

cve-2020-28163

libdwarf

null pointer

dereference

vulnerability

dwarf5

line-table

header

invalid form

pathname

crash

application

unix

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

50.9%

JSON

libdwarf before 20201201 allows a dwarf_print_lines.c NULL pointer dereference and application crash via a DWARF5 line-table header that has an invalid FORM for a pathname.

OSVersionArchitecturePackageVersionFilename
Debian12alldwarfutils< 20201201-1dwarfutils_20201201-1_all.deb
Debian11alldwarfutils< 20201201-1dwarfutils_20201201-1_all.deb
Debian999alldwarfutils< 20201201-1dwarfutils_20201201-1_all.deb
Debian13alldwarfutils< 20201201-1dwarfutils_20201201-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	dwarfutils	< 20201201-1	dwarfutils_20201201-1_all.deb
Debian	11	all	dwarfutils	< 20201201-1	dwarfutils_20201201-1_all.deb
Debian	999	all	dwarfutils	< 20201201-1	dwarfutils_20201201-1_all.deb
Debian	13	all	dwarfutils	< 20201201-1	dwarfutils_20201201-1_all.deb