CVE-2020-15158: Heap buffer overflow in libIEC61850
In libIEC61850 before version 1.4.3, when a message with COTP message length field with value < 4 is received an integer underflow will happen leading to heap buffer overflow. This can cause an application crash or on some platforms even the execution of remote code. If your application is used in open networks or there are untrusted nodes in the network it is highly recommend to apply the patch. This was patched with commit 033ab5b. Users of version 1.4.x should upgrade to version 1.4.3 when available. As a workaround changes of commit 033ab5b can be applied to older versions.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15158?
CVE-2020-15158 is classified as a high severity vulnerability due to the potential for heap buffer overflow and remote code execution.
How do I fix CVE-2020-15158?
To mitigate CVE-2020-15158, upgrade libIEC61850 to version 1.4.3 or later.
What is the impact of CVE-2020-15158?
CVE-2020-15158 can lead to application crashes and potentially allow remote code execution on affected systems.
Which versions of libIEC61850 are affected by CVE-2020-15158?
Versions of libIEC61850 prior to 1.4.3 are affected by CVE-2020-15158.
Is CVE-2020-15158 related to specific platforms?
Yes, CVE-2020-15158 may allow for remote code execution on some platforms, depending on the environment.