Lucene search

Gentoo FoundationMGASA-2021-0051

HistoryJan 23, 2021 - 2:50 a.m.

Updated blosc packages fix a security vulnerability

2021-01-2302:50:14

Gentoo Foundation

advisories.mageia.org

blosc security vulnerability fix heap-based buffer overflow unix library cve-2020-29367

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

36.8%

JSON

A heap-based buffer overflow vulnerability was found in the blosc library. Depending on how the library is used, if there is a lack of space to write compressed data, an attacker might exploit this flaw to crash the program or potentially execute arbitrary code (CVE-2020-29367).

OSVersionArchitecturePackageVersionFilename
Mageia7noarchblosc< 1.20.1-1blosc-1.20.1-1.mga7

OS	Version	Architecture	Package	Version	Filename
Mageia	7	noarch	blosc	< 1.20.1-1	blosc-1.20.1-1.mga7

References

bugs.mageia.org/show_bug.cgi?id=27953

lists.opensuse.org/archives/list/[email protected]/thread/VPTII3AXCRZZGBCOLCFY7HQI24L2PGVQ/

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

36.8%

JSON

Related for MGASA-2021-0051