CVE-2020-28928

MEDIUM

musl libc < 1.2.1 - Out-of-bounds Write in wcsnrtombs

Title source: llm

Description

In musl libc through 1.2.1, wcsnrtombs mishandles particular combinations of destination buffer size and source character limit, as demonstrated by an invalid write access (buffer overflow).

References (10)

Core 10

Core References

Release Notes, Vendor Advisory x_refsource_misc

https://musl.libc.org/releases.html

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2020/11/msg00050.html

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/ra63e8dc5137d952afc55dbbfa63be83304ecf842d1eab1ff3ebb29e2%40%3Cnotifications.apisix.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/r90b60cf49348e515257b4950900c1bd3ab95a960cf2469d919c7264e%40%3Cnotifications.apisix.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/r2134abfe847bea7795f0e53756d10a47e6643f35ab8169df8b8a9eb1%40%3Cnotifications.apisix.apache.org%3E

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW27QVY7ERPTSGKS4KAWE5TU7EJWHKVQ/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKQ3RVSMVZNZNO4D65W2CZZ4DMYFZN2Q/

Patch, Third Party Advisory x_refsource_misc

https://www.oracle.com//security-alerts/cpujul2021.html

Mailing List, Third Party Advisory x_refsource_confirm

http://www.openwall.com/lists/oss-security/2020/11/20/4

Patch, Third Party Advisory x_refsource_misc

https://www.oracle.com/security-alerts/cpuoct2021.html

Scores

CVSS v3 5.5

EPSS 0.0064

EPSS Percentile 46.6%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-787

Status published

Products (6)

debian/debian_linux 9.0

fedoraproject/fedora 33

fedoraproject/fedora 34

musl-libc/musl < 1.2.1

oracle/graalvm 20.3.2

oracle/graalvm 21.1.0

Published Nov 24, 2020

Tracked Since Feb 18, 2026