Buffer overflow in libuv (Alpine package)



Risk High
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2020-8252
CWE-ID CWE-120
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Adobe Reader
Client/Desktop applications / Office applications

libuv (Alpine package)
Operating systems & Components / Operating system package or component

Vendor Adobe
Alpine Linux Development Team

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Buffer overflow

EUVDB-ID: #VU47248

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-8252

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to incorrect validation of realpath in libuv. The library incorrectly determines the buffer size, which can result in a buffer overflow if the resolved path is longer than 256 bytes. A remote attacker can pass an overly long path to the application that is using the library, trigger memory corruption and execute arbitrary code on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Reader: 15.006.30097

libuv (Alpine package): 2.19-1

libuv (Alpine package): 0.108

libuv (Alpine package): 0.16.0-2

libuv (Alpine package): 0.7.2-1

libuv (Alpine package): 1.0.3-3 - 1.0.4-1

libuv (Alpine package): 1.3.8-1

libuv (Alpine package): 1.2.5-3ubuntu3

libuv (Alpine package): 3.6.3-0ubuntu1 - 3.6.4-0ubuntu8

libuv (Alpine package): 2.2.8-4 - 2.2.8-5

libuv (Alpine package): 0.1.1b-8

libuv (Alpine package): 5.4.0-4ubuntu1

libuv (Alpine package): 3.0.3-0.1 - 3.0.3-0.2

libuv (Alpine package): 1.6.3-1

libuv (Alpine package): 1.7-27 - 1.8-1

libuv (Alpine package): 2.10.2-2

libuv (Alpine package): 3.2.5-1 - 3.2.6-1

libuv (Alpine package): 2.18.50.20080806-0ubuntu1

libuv (Alpine package): 2.85.12

libuv (Alpine package): 6u131

libuv (Alpine package): 6.0.1.0

libuv (Alpine package): 0.2.80

libuv (Alpine package): 6.7.5-4

libuv (Alpine package): 2.2.2

libuv (Alpine package): 4.0d

libuv (Alpine package): 7

libuv (Alpine package): 8.1.6

libuv (Alpine package):

libuv (Alpine package): before 1.38.1-r0

CPE2.3 External links

https://git.alpinelinux.org/aports/commit/?id=7685b3c199f15e168ce4fd00eb5d5ec7c9bd458b
https://git.alpinelinux.org/aports/commit/?id=a482a6a5615894d7ac53517c87e5d5c6352eb68b


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###