CVE-2020-7450: Buffer Overflow

Published Feb 18, 2020

Updated

In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r357214, and 11.3-RELEASE before 11.3-RELEASE-p6, URL handling in libfetch with URLs containing username and/or password components is vulnerable to a heap buffer overflow allowing program misbehavior or malicious code execution.

Affected Software

20 affected components

FreeBSD FreeBSD=11.3

FreeBSD FreeBSD=11.3-p1

FreeBSD FreeBSD=11.3-p2

FreeBSD FreeBSD=11.3-p3

FreeBSD FreeBSD=11.3-p4

FreeBSD FreeBSD=11.3-p5

FreeBSD FreeBSD=12.0

FreeBSD FreeBSD=12.0-p1

FreeBSD FreeBSD=12.0-p10

FreeBSD FreeBSD=12.0-p11

FreeBSD FreeBSD=12.0-p12

FreeBSD FreeBSD=12.0-p2

FreeBSD FreeBSD=12.0-p3

FreeBSD FreeBSD=12.0-p4

FreeBSD FreeBSD=12.0-p6

FreeBSD FreeBSD=12.0-p7

FreeBSD FreeBSD=12.0-p8

FreeBSD FreeBSD=12.0-p9

FreeBSD FreeBSD=12.1

FreeBSD FreeBSD=12.1-p1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeBSD libfetch to a version that resolves this vulnerability.
Fixed in 12.1-STABLE before r357213Patch r357213
Upgrade
Upgrade FreeBSD libfetch to a version that resolves this vulnerability.
Fixed in 12.1-RELEASE before 12.1-RELEASE-p2Patch 12.1-RELEASE-p2
Upgrade
Upgrade FreeBSD libfetch to a version that resolves this vulnerability.
Fixed in 12.0-RELEASE before 12.0-RELEASE-p13Patch 12.0-RELEASE-p13
Upgrade
Upgrade FreeBSD libfetch to a version that resolves this vulnerability.
Fixed in 11.3-STABLE before r357214Patch r357214
Upgrade
Upgrade FreeBSD libfetch to a version that resolves this vulnerability.
Fixed in 11.3-RELEASE before 11.3-RELEASE-p6Patch 11.3-RELEASE-p6

Event History

Feb 18, 2020

CVE Published

via MITRE·03:26 PM

Data Sourced

via MITRE·03:26 PM

DescriptionWeakness

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2020-7450?

CVE-2020-7450 is classified as a medium to high severity vulnerability due to its potential to allow remote attackers to exploit affected systems.

How do I fix CVE-2020-7450?

To address CVE-2020-7450, update the affected FreeBSD system to a fixed version, specifically versions 11.3-RELEASE-p6, 12.0-RELEASE-p12, or 12.1-RELEASE-p1 and later.

What are the affected versions in CVE-2020-7450?

CVE-2020-7450 affects FreeBSD versions 11.3-RELEASE, 12.0-RELEASE, and 12.1 before their respective patched versions.

What type of vulnerability is CVE-2020-7450?

CVE-2020-7450 is a heap buffer overflow vulnerability occurring in URL handling of the libfetch library.

Can CVE-2020-7450 lead to unauthorized access?

Yes, CVE-2020-7450 could be exploited to execute arbitrary code, potentially leading to unauthorized access.