CVE-2020-29361: debian debian_linux Integer Overflow or Wraparound
Vulnerability summary
CVE-2020-29361 is a high (CVSS 7.5) Integer Overflow or Wraparound vulnerability in debian debian_linux. EPSS estimates a 3.47% chance of exploitation in the next 30 days, higher than 89% of scored vulnerabilities.
Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 3% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 2Timeline
- 16-12-2020PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.47%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
Increase +0.11 pp
From 3.36% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse25 products
- p11-kit&distro=SUSE Enterprise Storage 6< 0.23.2-4.13.1
- p11-kit&distro=SUSE Enterprise Storage 7< 0.23.2-4.13.1
- p11-kit&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 0.23.2-4.13.1
- p11-kit&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 0.23.2-4.13.1
- p11-kit&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS< 0.23.2-4.13.1
Debian2 products
- p11-kit< 0.23.22-1
- debian_linuxEOL9.0 | 10.0
Opensuse2 products
- p11-kit&distro=openSUSE Leap 15.2< 0.23.2-lp152.7.3.1
- p11-kit&distro=openSUSE Leap 15.3< 0.23.2-4.13.1
Alpine1 product
- p11-kit≥ 0.21.1, < 0.23.16.1-r1 | ≥ 0.21.1, < 0.23.18.1-r1 | ≥ 0.21.1, < 0.23.22-r0
P11-kit_project1 product
- p11-kit≥ 0.21.1, ≤ 0.23.21
Ubuntu1 product
- p11-kit< 0.23.2-5~ubuntu16.04.2 | < 0.23.9-2ubuntu0.1 | < 0.23.20-1ubuntu0.1 | < 0.20.2-2ubuntu2+esm1
6 vendors · 32 products
References
21 links- github.com/p11-glue/p11-kit/security/advisories/GHSA-q4r3-hm6m-mvc2X Refsource MISCREPORTThird Party Advisory
- lists.debian.org/debian-lts-announce/2021/01/msg00002.htmlMailing ListX Refsource MLISTThird Party Advisory
Show all 21 references
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory
