Lucene search

K
ubuntucveUbuntu.comUB:CVE-2020-35357
HistoryAug 22, 2023 - 12:00 a.m.

CVE-2020-35357

2023-08-2200:00:00
ubuntu.com
ubuntu.com
2
buffer overflow
gnu scientific library
quantile calculation
malicious input
arbitrary code execution
unix

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

31.4%

A buffer overflow can occur when calculating the quantile value using the
Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6.
Processing a maliciously crafted input data for
gsl_stats_quantile_from_sorted_data of the library may lead to unexpected
application termination or arbitrary code execution.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchgsl< 2.4+dfsg-6ubuntu0.1~esm1UNKNOWN
ubuntu20.04noarchgsl< 2.5+dfsg-6+deb10u1build0.20.04.1UNKNOWN
ubuntu22.04noarchgsl< 2.7.1+dfsg-3ubuntu0.22.04.1~esm1UNKNOWN
ubuntu23.04noarchgsl< 2.7.1+dfsg-3ubuntu0.23.04.1UNKNOWN
ubuntu16.04noarchgsl< 2.1+dfsg-2ubuntu0.1~esm1UNKNOWN

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

31.4%