CVE-2020-27350

EUVD-2020-19862
APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.7 MEDIUM
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
canonicalCNA
5.7 MEDIUM
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 38%
Affected Products (NVD)
VendorProductVersion
debianadvanced_package_tool
1.2.32ubuntu0 ≤
𝑥
< 1.2.32ubuntu0.2
debianadvanced_package_tool
1.6.12ubuntu0 ≤
𝑥
< 1.6.12ubuntu0.2
debianadvanced_package_tool
2.0.2ubuntu0 ≤
𝑥
< 2.0.2ubuntu0.2
debianadvanced_package_tool
2.1.10ubuntu0 ≤
𝑥
< 2.1.10ubuntu0.2
debianadvanced_package_tool
𝑥
< 1.8.2.2
netappsolidfire_baseboard_management_controller_firmware
-
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
apt
bookworm
2.6.1
fixed
bullseye
2.2.4
fixed
sid
2.9.10
fixed
trixie
2.9.10
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
apt
bionic
Fixed 1.6.12ubuntu0.2
released
focal
Fixed 2.0.2ubuntu0.2
released
groovy
Fixed 2.1.10ubuntu0.1
released
hirsute
Fixed 2.1.13
released
trusty
Fixed 1.0.1ubuntu2.24+esm3
released
xenial
Fixed 1.2.32ubuntu0.2
released
Common Weakness Enumeration
References
https://bugs.launchpad.net/bugs/1899193
https://security.netapp.com/advisory/ntap-20210108-0005/
https://usn.ubuntu.com/usn/usn-4667-1
https://www.debian.org/security/2020/dsa-4808
https://bugs.launchpad.net/bugs/1899193
https://security.netapp.com/advisory/ntap-20210108-0005/
https://usn.ubuntu.com/usn/usn-4667-1
https://www.debian.org/security/2020/dsa-4808