GoogleOSV:CVE-2020-36403

HistoryJul 01, 2021 - 3:15 a.m.

CVE-2020-36403

2021-07-0103:15:07

Google

osv.dev

6.9 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

75.1%

JSON

HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).

CPENameOperatorVersion
htslibeqstable1
htslibeq1.6
htslibeq0.2.0-rc10
htslibeq0.2.0-rc7
htslibeq1.2
htslibeq1.1
htslibeqcf-direct-final
htslibeq1.10.2
htslibeq1.5
htslibeq1.7

Name	Operator	Version
htslib	eq	stable1
htslib	eq	1.6
htslib	eq	0.2.0-rc10
htslib	eq	0.2.0-rc7
htslib	eq	1.2
htslib	eq	1.1
htslib	eq	cf-direct-final
htslib	eq	1.10.2
htslib	eq	1.5
htslib	eq	1.7

Rows per page:

1-10 of 321

References

bugs.chromium.org/p/oss-fuzz/issues/detail?id=24097

github.com/google/oss-fuzz-vulns/blob/main/vulns/htslib/OSV-2020-955.yaml

github.com/samtools/htslib/commit/dcd4b7304941a8832fba2d0fc4c1e716e7a4e72c

github.com/samtools/htslib/pull/1447