CVE-2019-20367
criticalnlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).
Vendor / product: Freedesktop — libbsd
nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).
CVSS
9.1
9.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2020-01-08 17:15
Modified: 2026-10-14 08:17
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
freedesktop / libbsd <0.10.0
debian / debian_linux 9.0
canonical / ubuntu_linux 12.04, 14.04, 16.04, 18.04, 19.04
opensuse / leap 15.1
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://gitlab.freedesktop.org/libbsd/libbsd/commit/9d917aad37778a9f4a96ba358415f077f3f36f3b
References
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00043.html cve@mitre.org
- https://gitlab.freedesktop.org/libbsd/libbsd/commit/9d917aad37778a9f4a96ba358415f077f3f36f... cve@mitre.org
- https://lists.apache.org/thread.html/r0e913668380f59bcbd14fdd8ae8d24f95f99995e290cd18a7822... cve@mitre.org
- https://lists.apache.org/thread.html/ra781e51cf1ec40381c98cddc073b3576fb56c3978f4564d2fa43... cve@mitre.org
- https://lists.debian.org/debian-lts-announce/2021/02/msg00027.html cve@mitre.org
- https://lists.freedesktop.org/archives/libbsd/2019-August/000229.html cve@mitre.org
- https://usn.ubuntu.com/4243-1/ cve@mitre.org
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00043.html af854a3a-2127-422b-91ae-364da2661108
- https://gitlab.freedesktop.org/libbsd/libbsd/commit/9d917aad37778a9f4a96ba358415f077f3f36f... af854a3a-2127-422b-91ae-364da2661108
- https://lists.apache.org/thread.html/r0e913668380f59bcbd14fdd8ae8d24f95f99995e290cd18a7822... af854a3a-2127-422b-91ae-364da2661108
- https://lists.apache.org/thread.html/ra781e51cf1ec40381c98cddc073b3576fb56c3978f4564d2fa43... af854a3a-2127-422b-91ae-364da2661108
- https://lists.debian.org/debian-lts-announce/2021/02/msg00027.html af854a3a-2127-422b-91ae-364da2661108
- https://lists.freedesktop.org/archives/libbsd/2019-August/000229.html af854a3a-2127-422b-91ae-364da2661108
- https://usn.ubuntu.com/4243-1/ af854a3a-2127-422b-91ae-364da2661108
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗