CVE-2020-10531: canonical ubuntu_linux Integer Overflow or Wraparound
Modified
AliasesALPINE-CVE-2020-10531SUSE-OU-2024:0647-1SUSE-SU-2020:0819-1SUSE-SU-2020:0819-2SUSE-SU-2020:1180-1RHSA-2020:0896RHSA-2020:0897RHSA-2020:0901RHSA-2020:0902RHSA-2020:1293RHSA-2020:1317RHSA-2020:1343UBUNTU-CVE-2020-10531USN-4305-1DEBIAN-CVE-2020-10531DLA-2151-1DSA-4646-1openSUSE-SU-2020:0459-1
Published 12-03-2020Last modified 14-10-2026
Vulnerability summary
CVE-2020-10531 is a high (CVSS 8.8) Integer Overflow or Wraparound vulnerability in canonical ubuntu_linux. EPSS estimates a 2.67% chance of exploitation in the next 30 days, higher than 85.7% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 8.8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
2.67%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 9 · Related 6Timeline
- 12-03-2020PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
2.67%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.67% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Version check
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Suse40 products
- icu&distro=HPE Helion OpenStack 8< 52.1-8.10.1
- icu&distro=SUSE Enterprise Storage 5< 52.1-8.10.1
- icu&distro=SUSE Enterprise Storage 7.1< 60.2-150000.3.15.4
- icu&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 60.2-150000.3.15.4
- icu&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 60.2-150000.3.15.4
Redhat20 products
- enterprise_linux_desktop6.0
- enterprise_linux_server6.0
- enterprise_linux_workstation6.0
- icu< 0:4.2.1-15.el6_10 | < 0:50.2-4.el7_7 | < 0:60.3-2.el8_0 | < 0:60.3-2.el8_1
- icu-debuginfo< 0:4.2.1-15.el6_10 | < 0:50.2-4.el7_7 | < 0:60.3-2.el8_0 | < 0:60.3-2.el8_1
Debian2 products
- icu< 57.1-6+deb9u4 | < 63.1-6+deb10u1 | < 52.1-8+deb8u8 | < 63.2-3
- debian_linuxEOL8.0 | 9.0 | 10.0
Opensuse2 products
- leapEOL15.1
- icu&distro=openSUSE Leap 15.1< 60.2-lp151.3.11.1
Ubuntu2 products
- chromium-browser< 80.0.3987.149-0ubuntu0.16.04.1 | < 80.0.3987.149-0ubuntu0.18.04.1
- icu< 52.1-3ubuntu0.8+esm1 | < 55.1-7ubuntu0.5 | < 60.2-3ubuntu3.1
Alpine1 product
- icu< 64.2-r1 | < 65.1-r1 | < 60.2-r3 | < 62.1-r1
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 19.10
Fedoraproject1 product
- fedoraEOL30 | 31 | 33
Google1 product
- chrome< 80.0.3987.122
Icu-project1 product
Nodejs1 product
- node.js≥ 10.0.0, ≤ 10.12.0 | ≥ 10.13.0, < 10.21.0
Oracle1 product
- banking_extensibility_workbench14.3.0 | 14.4.0
12 vendors · 73 products
References
50 links
lists.debian.org/debian-lts-announce/2020/03/msg00024.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.opensuse.org/opensuse-security-announce/2020-04/msg00004.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 50 references
- chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_24.htmlX Refsource MISCARTICLEREPORTThird Party Advisory
- bugs.chromium.org/p/chromium/issues/detail?id=1044570X Refsource MISCPermissions RequiredThird Party Advisory
- chromium.googlesource.com/chromium/deps/icu/+/9f4020916eb1f28f3666f018fdcbe6c9a37f0e08X Refsource MISCPatchThird Party Advisory
- github.com/unicode-org/icu/commit/b7d08bc04a4296982fcef8b6b8a354a9e4e7afcaX Refsource MISCPatchThird Party Advisory
- lists.opensuse.org/archives/…Advisory