CVE-2020-17360 Information

Description

LICENSE README.md cvefilelist cvelist nvdcve nvdpages.sh scripts test-CVE-2017-1882.markdown test-CVE-2017-18822.markdown tmpvendorlinks UNSUPPORTED WHEN ASSIGNED LICENSE README.md cvefilelist cvelist nvdcve nvdpages.sh scripts test-CVE-2017-1882.markdown test-CVE-2017-18822.markdown tmpvendorlinks An issue was discovered in ReadyTalk Avian 1.2.0. The vm::arrayCopy method defined in classpath-common.h contains multiple boundary checks that are performed to prevent out-of-bounds memory read/write. However two of these boundary checks contain an integer overflow that leads to a bypass of these checks and out-of-bounds read/write. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Reference

http://seclists.org/fulldisclosure/2020/Aug/8 http://seclists.org/fulldisclosure/2020/Sep/11 http://seclists.org/fulldisclosure/2020/Sep/13 http://seclists.org/fulldisclosure/2020/Sep/14 https://github.com/ReadyTalk/avian/issues

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

7.8