CVE-2020-7450
Severity CVSS v4.0:
Pending analysis
Type:
CWE-787
Out-of-bounds Write
Publication date:
18/02/2020
Last modified:
05/03/2020
Description
In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r357214, and 11.3-RELEASE before 11.3-RELEASE-p6, URL handling in libfetch with URLs containing username and/or password components is vulnerable to a heap buffer overflow allowing program misbehavior or malicious code execution.
Impact
Base Score 3.x
9.80
Severity 3.x
CRITICAL
Base Score 2.0
7.50
Severity 2.0
HIGH
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:o:freebsd:freebsd:11.3:-:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:11.3:p1:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:11.3:p2:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:11.3:p3:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:11.3:p4:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:11.3:p5:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:12.0:-:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:12.0:p1:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:12.0:p10:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:12.0:p11:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:12.0:p12:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:12.0:p2:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:12.0:p3:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:12.0:p4:*:*:*:*:*:* | ||
cpe:2.3:o:freebsd:freebsd:12.0:p6:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page