Vulnerability · Published Feb 18, 2020 · Assigned by freebsd
CVE-2020-7450
Critical 9.8
In plain English
A critical-severity security flaw in FreeBSD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.5%top 15.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r357214, and 11.3-RELEASE before 11.3-RELEASE-p6, URL handling in libfetch with URLs containing username and/or password components is vulnerable to a heap buffer overflow allowing program misbehavior or malicious code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | xbps | 0.58-r0 | ALPINE-CVE-2020-7450 |
| Alpine:v3.21 | xbps | 0.58-r0 | ALPINE-CVE-2020-7450 |
| Alpine:v3.22 | xbps | 0.58-r0 | ALPINE-CVE-2020-7450 |
| Alpine:v3.23 | xbps | 0.58-r0 | ALPINE-CVE-2020-7450 |
| Alpine:v3.24 | xbps | 0.58-r0 | ALPINE-CVE-2020-7450 |