CRITICAL
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate report
Published Jul 27, 2020
9.8
CRITICALCVSS 3.1
EPSS 3.68%
Description
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate report. This can cause remote memory corruption when a '\0' byte overwrites the heap metadata of the next chunk and its PREV_INUSE flag.
Affected products
No data.
Configuration 1
OR
- ≤ 1.3.2
- 1.4.0
- 1.4.0
Configuration 2
OR
- 33
- 34
Configuration 3
- 9.0
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (8)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-4769 Advisory
- https://github.com/trusteddomainproject/OpenDMARC/issues/64 x_refsource_MISCExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/04/msg00026.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2D4JGHMALEJEWWG56DKR5OZB22TK7W5B/ vendor-advisoryx_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JHDKMCZGE3W4XBP76NLI2Q7IOZHXLD4A/ vendor-advisoryx_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KBOGOQOK3TIWWJV66MW5YWNRJAFFYGR5/ vendor-advisoryx_refsource_FEDORA
- https://security.gentoo.org/glsa/202011-02 vendor-advisoryx_refsource_GENTOOThird Party Advisory
- https://sourceforge.net/projects/opendmarc/ x_refsource_MISCProductThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-4769 | Advisory | |
| https://github.com/trusteddomainproject/OpenDMARC/issues/64 | x_refsource_MISCExploitThird Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2021/04/msg00026.html | mailing-listx_refsource_MLISTMailing ListThird Party Advisory | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2D4JGHMALEJEWWG56DKR5OZB22TK7W5B/ | vendor-advisoryx_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JHDKMCZGE3W4XBP76NLI2Q7IOZHXLD4A/ | vendor-advisoryx_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KBOGOQOK3TIWWJV66MW5YWNRJAFFYGR5/ | vendor-advisoryx_refsource_FEDORA | |
| https://security.gentoo.org/glsa/202011-02 | vendor-advisoryx_refsource_GENTOOThird Party Advisory | |
| https://sourceforge.net/projects/opendmarc/ | x_refsource_MISCProductThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jul 27, 2020
Updated Aug 4, 2024
Reserved Apr 29, 2020
Link CVE-2020-12460
CISA Vulnrichment
No data
Red Hat
No data
GitHub
No data