Vulnerability · Published Sep 16, 2020 · Assigned by redhat
CVE-2020-14315
Critical 9.8
In plain English
A critical-severity out-of-bounds write in bsdiff. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.6%top 14.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A memory corruption vulnerability is present in bspatch as shipped in Colin Percival’s bsdiff tools version 4.3. Insufficient checks when handling external inputs allows an attacker to bypass the sanity checks in place and write out of a dynamically allocated buffer boundaries.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | bsdiff | 4.3-22 | DEBIAN-CVE-2020-14315 |
| Debian:13 | bsdiff | 4.3-22 | DEBIAN-CVE-2020-14315 |
| Debian:14 | bsdiff | 4.3-22 | DEBIAN-CVE-2020-14315 |
| Ubuntu:22.04:LTS | bsdiff | no fix listed | UBUNTU-CVE-2020-14315 |
| Ubuntu:24.04:LTS | bsdiff | no fix listed | UBUNTU-CVE-2020-14315 |
| Ubuntu:25.10 | bsdiff | no fix listed | UBUNTU-CVE-2020-14315 |
| Ubuntu:26.04:LTS | bsdiff | no fix listed | UBUNTU-CVE-2020-14315 |
| Ubuntu:26.10 | bsdiff | no fix listed | UBUNTU-CVE-2020-14315 |
Affected products (as reported)
Weakness: CWE-787
References
- https://www.openwall.com/lists/oss-security/2020/07/09/2 x_refsource_MISC
- https://www.x41-dsec.de/lab/advisories/x41-2020-006-bspatch/ x_refsource_MISC
- https://bugzilla.redhat.com/show_bug.cgi?id=1856747 x_refsource_MISC