CVE-2020-20412: Out-of-bounds Read

Q: What is the severity of CVE-2020-20412?

CVE-2020-20412 has been classified as a significant vulnerability due to its potential for arbitrary code execution through insufficient array bounds checking.

Q: How do I fix CVE-2020-20412?

To remediate CVE-2020-20412, upgrade to libvorbis version 1.3.6 or later and consider updating StepMania to a secure version.

Q: What products are affected by CVE-2020-20412?

CVE-2020-20412 affects libvorbis versions prior to 1.3.6 and StepMania version 5.0.12.

Q: What is the nature of the vulnerability in CVE-2020-20412?

CVE-2020-20412 presents an array bounds checking issue that can be exploited through specially crafted OGG files.

Q: Is CVE-2020-20412 related to any other vulnerabilities?

Yes, CVE-2020-20412 may overlap with CVE-2018-5146, which indicates a similar class of vulnerabilities.

Published Dec 26, 2020

Updated

lib/codebook.c in libvorbis before 1.3.6, as used in StepMania 5.0.12 and other products, has insufficient array bounds checking via a crafted OGG file. NOTE: this may overlap CVE-2018-5146.

Affected Software

2 affected components

StepMania StepMania=5.0.12

Xiph.org libvorbis>=1.3.2<1.3.6

Remediation

Patch Available

https://github.com/stepmania/stepmania/issues/1890

Event History

Dec 26, 2020

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2020-20412?

CVE-2020-20412 has been classified as a significant vulnerability due to its potential for arbitrary code execution through insufficient array bounds checking.

How do I fix CVE-2020-20412?