CVE-2020-12460: Critical severity opendmarc vulnerability
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarcxmlparse that can result in a one-byte heap overflow in opendmarcxml when parsing a specially crafted DMARC aggregate report. This can cause remote memory corruption when a '\0' byte overwrites the heap metadata of the next chunk and its PREVINUSE flag.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-12460?
The severity of CVE-2020-12460 is high.
How does CVE-2020-12460 occur?
CVE-2020-12460 occurs due to improper null termination in the function opendmarc_xml_parse.
What is the impact of CVE-2020-12460?
The impact of CVE-2020-12460 is a one-byte heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate report, which can cause remote memory corruption.
Which versions of OpenDMARC are affected by CVE-2020-12460?
OpenDMARC versions 1.3.2 through 1.3.2-6+deb10u4, 1.4.x through 1.4.0-Beta1, 1.4.0~beta1+dfsg-6+deb11u1, 1.4.2-2, and 1.4.2-3 are affected by CVE-2020-12460.
How can I fix CVE-2020-12460?
To fix CVE-2020-12460, update OpenDMARC to a version that includes the necessary remedy, such as version 1.3.2-6+deb10u4 or later.