CVEvulnerability

CVE-2020-8244

6.5 MEDIUM Published 2020-08-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-08-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS 2.0 ([email protected])
6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:P
Weaknesses
CWE-125, CWE-126

Description

A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.

Affected configurations

• bufferlist project bufferlist (< 1.2.3) • bufferlist project bufferlist (>= 2.0.0 < 2.2.1) • bufferlist project bufferlist (>= 3.0.0 < 3.0.1) • bufferlist project bufferlist (>= 4.0.0 < 4.0.3) • debian debian linux 9.0

Related

Weakness · CWE (2)

  • CWE-125 Out-of-bounds Read weakness
  • CWE-126 Buffer Over-read weakness

References