Base Score

MEDIUM6.5

CVE-2020-1983

A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.

VectorLOCAL

Published Bypsirt@paloaltonetworks.com

Published DateApr 22, 2020, 20:15

Weakness Type (CWE):CWE-416

CVSS Metrics

Base Score

6.5

Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Base Severity

MEDIUM

Version

3.1

Attack Vector (AV)

LOCAL

Attack Complexity (AC)

LOW

Privileges Required (PR)

LOW

User Interaction (UI)

NONE

Scope (S)

CHANGED

Confidentiality (C)

NONE

Integrity (I)

NONE

Availability (A)

HIGH

References

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00022.html
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00001.html
https://gitlab.freedesktop.org/slirp/libslirp/-/commit/9ac0371bb8c0a40f5d9f82a1c25129660e81df04
https://gitlab.freedesktop.org/slirp/libslirp/-/issues/20
https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html
https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWFD4MWV3YWIHVHSA2F7FKOLJFL4PHOX/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKT2MTSINE4NUPG5L6BYH6N23NBNITOL/
https://usn.ubuntu.com/4372-1/
https://www.debian.org/security/2020/dsa-4665

Base Score

MEDIUM6.5

Weakness Type (CWE):CWE-416

CVSS Metrics

Base Score

6.5

Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Base Severity

MEDIUM

Version

3.1

Attack Vector (AV)

LOCAL

Attack Complexity (AC)

LOW

Privileges Required (PR)

LOW

User Interaction (UI)

NONE

Scope (S)

CHANGED

Confidentiality (C)

NONE

Integrity (I)

NONE

Availability (A)

HIGH