Out-of-bounds read in apt - CVE-2020-3810
Published: May 14, 2020
Vulnerability identifier: #VU27922
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-3810
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the Ararchive::Loadheaders in /apt-pkg/contrib/arfile.cc. A remote attacker can create a specially crafted repository file, trick the victim into loading it, trigger an out-of-bounds read error and gain access to sensitive information.
Affected software
apt
apt (Ubuntu package)
apt (Debian package)
apt
Fedora
apt (Ubuntu package)
apt (Debian package)
apt
Fedora
How to mitigate CVE-2020-3810
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
apt (Ubuntu package) - addressed in versions 0.8.16~exp12ubuntu10.29, 1.0.1ubuntu2.24+esm1, 1.2.32ubuntu0.1, 1.6.12ubuntu0.1, 1.9.4ubuntu0.1, 2.0.2ubuntu0.1
apt (Debian package) - addressed in versions 1.4.10, 1.8.2.1
apt - update to 2.1.7-1.fc32
apt (Debian package) - addressed in versions 1.4.10, 1.8.2.1
apt - update to 2.1.7-1.fc32