Vulnerability Details : CVE-2020-14392
An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to manipulate calls to dbd_db_login6_sv() could cause memory corruption, affecting the service's availability.
Vulnerability category: OverflowMemory Corruption
Products affected by CVE-2020-14392
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:perl:database_interface:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-14392
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-14392
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:N/I:N/A:P |
3.9
|
2.9
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2020-14392
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
-
The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.Assigned by: secalert@redhat.com (Secondary)
References for CVE-2020-14392
-
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00074.html
[security-announce] openSUSE-SU-2020:1502-1: important: Security updateMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXLKODJ7B57GITDEZZXNSHPK4VBYXYHR/
[SECURITY] Fedora 31 Update: perl-DBI-1.643-3.fc31 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2020/09/msg00026.html
[SECURITY] [DLA 2386-1] libdbi-perl security updateMailing List;Third Party Advisory
-
https://usn.ubuntu.com/4503-1/
USN-4503-1: Perl DBI module vulnerability | Ubuntu security notices | UbuntuThird Party Advisory
-
https://metacpan.org/pod/distribution/DBI/Changes#Changes-in-DBI-1.643
DBI::Changes - List of significant changes to the DBI - metacpan.orgRelease Notes;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00067.html
[security-announce] openSUSE-SU-2020:1483-1: important: Security updateThird Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1877402
1877402 – (CVE-2020-14392) CVE-2020-14392 perl-dbi: Memory corruption in XS functions when Perl stack is reallocatedIssue Tracking;Third Party Advisory
Jump to