CVE-2020-14155CWE-190

CVE-2020-14155

Medium · published June 15, 2020

CVSS v3.1
5.3
EPSS
4%
Percentile
90.9
In the wild
Unconfirmed
What it is

libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.04182 · 90.9th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2020-06-15T21:15Z
Affected products (22)
ProductVersionsFixed in
pcre/pcre< 8.448.44
apple/macos< 11.0.111.0.1
gitlab/gitlab< 12.10.1312.10.13
gitlab/gitlab< 12.10.1312.10.13
gitlab/gitlab≥ 13.0.0, < 13.0.813.0.8
gitlab/gitlab≥ 13.0.0, < 13.0.813.0.8
gitlab/gitlab≥ 13.1.0, < 13.1.213.1.2
gitlab/gitlab≥ 13.1.0, < 13.1.213.1.2
oracle/communications_cloud_native_core_policyall versions—
netapp/active_iq_unified_managerall versions—
netapp/cloud_backupall versions—
netapp/clustered_data_ontapall versions—
netapp/ontap_select_deploy_administration_utilityall versions—
netapp/steelstore_cloud_integrated_storageall versions—
netapp/h410c_firmwareall versions—
netapp/h300s_firmwareall versions—
netapp/h500s_firmwareall versions—
netapp/h700s_firmwareall versions—
netapp/h410s_firmwareall versions—
splunk/universal_forwarder≥ 8.2.0, < 8.2.128.2.12
splunk/universal_forwarder≥ 9.0.0, < 9.0.69.0.6
splunk/universal_forwarderall versions—
References (20)
http://seclists.org/fulldisclosure/2020/Dec/32 · [email protected]http://seclists.org/fulldisclosure/2021/Feb/14 · [email protected]https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/ · [email protected]https://bugs.gentoo.org/717920 · [email protected]https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E · [email protected]https://security.netapp.com/advisory/ntap-20221028-0010/ · [email protected]https://support.apple.com/kb/HT211931 · [email protected]https://support.apple.com/kb/HT212147 · [email protected]https://www.oracle.com/security-alerts/cpuapr2022.html · [email protected]https://www.pcre.org/original/changelog.txt · [email protected]http://seclists.org/fulldisclosure/2020/Dec/32 · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2021/Feb/14 · af854a3a-2127-422b-91ae-364da2661108https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/ · af854a3a-2127-422b-91ae-364da2661108https://bugs.gentoo.org/717920 · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20221028-0010/ · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT211931 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT212147 · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2022.html · af854a3a-2127-422b-91ae-364da2661108https://www.pcre.org/original/changelog.txt · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 15 JUN 00:00Z
    libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring
    cvelistv5