CVEvulnerability

CVE-2020-1752

7.0 HIGH Published 2020-04-30 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2020-04-30
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.0 HIGH — CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
7.0 HIGH — CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
3.7 LOW — AV:L/AC:H/Au:N/C:P/I:P/A:P
Weaknesses
CWE-416

Description

A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.

Affected configurations

• gnu glibc (< 2.32.0) • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • canonical ubuntu linux 19.10 • netapp active iq unified manager (>= 9.5) • netapp hci management node • netapp solidfire • netapp steelstore cloud integrated storage • netapp h410c firmware • debian debian linux 10.0

Related

Weakness · CWE (1)

References