CVE Vulnerability

CVE-2020-27350

APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;

4.6 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

5.7 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.5 / Impact : 3.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References
Link Resource
https://usn.ubuntu.com/usn/usn-4667-1 Vendor Advisory
https://bugs.launchpad.net/bugs/1899193 Broken Link
https://www.debian.org/security/2020/dsa-4808 Vendor Advisory
https://security.netapp.com/advisory/ntap-20210108-0005/ Third Party Advisory
Configurations

Configuration 1
Information

Published : 2020-12-10 04:15

Updated : 2022-10-29 02:41

NVD link : CVE-2020-27350

Mitre link : CVE-2020-27350

Products Affected

Advanced Package Tool

Debian

CWE
CWE-190