CVE-2020-8794: canonical ubuntu_linux Out-of-bounds Read
Vulnerability summary
CVE-2020-8794 is a high (CVSS 10.0) Out-of-bounds Read vulnerability in canonical ubuntu_linux. EPSS estimates a 88.90% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 7 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 25-02-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
88.90%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 88.90% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
7 foundExploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Show all 7 exploits
Exploit Reference (openwall.com)
Maturity: unknown
OpenSMTPD - OOB Read Local Privilege Escalation (Metasploit)
Maturity: weaponized
OpenSMTPD < 6.6.3p1 - Local Privilege Escalation + Remote Code Execution
Maturity: poc
OpenSMTPD OOB Read Local Privilege Escalation
exploit/unix/local/opensmtpd_oob_read_lpe
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian2 products
- opensmtpd< 6.6.4p1-1 | < 6.0.2p1-2+deb9u3 | < 6.0.3p1-5+deb10u4
- debian_linuxEOL9.0 | 10.0
Canonical1 product
- ubuntu_linuxEOL18.04 | 19.10
Fedoraproject1 product
- fedoraEOL31 | 32
Opensmtpd1 product
- opensmtpd< 6.6.4
Ubuntu1 product
- opensmtpd< 5.7.3p2-1ubuntu0.1~esm2 | < 6.0.3p1-1ubuntu0.2 | < 6.6.4p1-1
5 vendors · 6 products
References
16 links- www.openwall.com/lists/oss-security/2020/02/24/5X Refsource MISCExploitMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2020/02/26/1Mailing ListX Refsource MLISTExploitThird Party Advisory
- packetstormsecurity.com/files/156633/OpenSMTPD-Out-Of-Bounds-Read-Local-Privilege-Escalation.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
Show all 16 references
- www.openwall.com/lists/oss-security/2021/05/04/7Mailing ListX Refsource MLISTExploitThird Party Advisory