CVE-2020-14392: canonical ubuntu_linux Untrusted Pointer Dereference
CVSS: 5.5v3.1MediumModified
AliasesALPINE-CVE-2020-14392UBUNTU-CVE-2020-14392USN-4503-1DEBIAN-CVE-2020-14392
Published 16-09-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-14392 is a medium (CVSS 5.5) Untrusted Pointer Dereference vulnerability in canonical ubuntu_linux. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 45.3% of scored vulnerabilities.
CVSS score
5.5/10
010
Medium · v3.1 (NVD)EPSS score
0.55%
0%100%
Low · -0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 9 · Related 7Timeline
- 16-09-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to manipulate calls to dbd_db_login6_sv() could cause memory corruption, affecting the service's availability.
CVSS metrics
5 scores · 4 sources · 2 versionsMedium 5.5Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Low 2.1Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
0.55%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
-0.02 pp
From 0.58% on 21-09-2026
21-09-202621-10-2026
EPSS score0.55%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-822Untrusted Pointer DereferenceThe product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.
- CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Affected systems
Debian2 products
- libdbi-perl< 1.643-1
- debian_linuxEOL9.0
Alpine1 product
- perl-dbi< 1.643-r0
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04
Fedoraproject1 product
- fedoraEOL31
Opensuse1 product
- leapEOL15.1 | 15.2
Perl1 product
- database_interface< 1.643
Ubuntu1 product
- libdbi-perl< 1.630-1ubuntu0.1~esm1 | < 1.634-1ubuntu0.1 | < 1.640-1ubuntu0.1
7 vendors · 8 products
References
12 links- lists.opensuse.org/opensuse-security-announce/2020-09/msg00067.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-09/msg00074.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2020/09/msg00026.htmlMailing ListX Refsource MLISTThird Party Advisory