CVE-2020-3810

Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb files.

Published: May 15, 2020
Updated: Apr 14, 2023
CVE: CVE-2020-3810
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.5
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P

CWEs:

CWE-20
CWE-125

Affected Software
References

Software	From	Fixed in
debian / debian_linux	9.0	9.0.x
debian / debian_linux	10.0	10.0.x
debian / apt	-	2.1.2
fedoraproject / fedora	32	32.x
canonical / ubuntu_linux	18.04	18.04.x
canonical / ubuntu_linux	14.04	14.04.x
canonical / ubuntu_linux	19.10	19.10.x
canonical / ubuntu_linux	20.04	20.04.x
canonical / ubuntu_linux	16.04	16.04.x
canonical / ubuntu_linux	12.04	12.04.x

https://bugs.launchpad.net/bugs/1878177
https://github.com/Debian/apt/issues/111
https://lists.debian.org/debian-security-announce/2020/msg00089.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4PEH357MZM2SUGKETMEHMSGQS652QHH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4PEH357MZM2SUGKETMEHMSGQS652QHH/
https://salsa.debian.org/apt-team/apt/-/commit/dceb1e49e4b8e4dadaf056be34088b415939cda6
https://tracker.debian.org/news/1144109/accepted-apt-212-source-into-unstable/
https://usn.ubuntu.com/4359-1/
https://usn.ubuntu.com/4359-2/

Vulnerability Database

CVE-2020-3810