Input validation error in NASM - CVE-2020-21528

Vulnerability identifier: #VU84812

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-21528

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the ieee_segment() function in outieee.c. A remote attacker can pass specially crafted assembly file to the compiler and perform a denial of service (DoS) attack.

NASM
Gentoo Linux
Amazon Linux AMI
openEuler
nasm
nasm-debugsource
nasm-debuginfo
nasm-help
dev-lang/nasm

Install updates from vendor's website.

nasm - update to 2.15.03-7
nasm-debugsource - update to 2.15.03-7
nasm-debuginfo - update to 2.15.03-7
nasm-help - update to 2.15.03-7
nasm - update to 2.15.05-1
dev-lang/nasm - update to 2.16.01

• https://bugzilla.nasm.us/show_bug.cgi?id=3392637
• https://security.gentoo.org/glsa/202312-09

• Denial of service in NASM
• Gentoo update for NASM
• openEuler update for nasm
• Amazon Linux AMI update for nasm