CVE-2020-35357
A buffer overflow can occur when calculating the quantile value using the Statistics Library of...
A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.
- Record
CVE-2020-35357- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
CVE List No score
A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.
- Record
CVE-2020-35357- Updated
- 2026-11-02
EUVDEUVD-2020-23033 No score
A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.
- Record
EUVD-2020-23033- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xp4h-43w8-c7qr
A buffer overflow can occur when calculating the quantile value using the Statistics Library of...
A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.
- Record
GHSA-xp4h-43w8-c7qr- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSVAZL-43711
CVE-2020-35357 affecting package gsl 2.6-3
A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.
- Record
AZL-43711- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-45111
CVE-2020-35357 affecting package gsl for versions less than 2.8-1
A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.
- Record
AZL-45111- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSV
A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.
- Record
CVE-2020-35357- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-06
OSVDEBIAN-CVE-2020-35357
A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.
- Record
DEBIAN-CVE-2020-35357- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-35357
A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.
- Record
UBUNTU-CVE-2020-35357- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2023:3527-1 No score
Security update for gsl
This update for gsl fixes the following issues:
- CVE-2020-35357: Fixed a stack out of bounds read in gsl_stats_quantile_from_sorted_data(). (bsc#1214681)
- Record
SUSE-SU-2023:3527-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3858-1 No score
Security update for gsl
This update for gsl fixes the following issues:
- CVE-2020-35357: Fixed a stack out of bounds read in gsl_stats_quantile_from_sorted_data(). (bsc#1214681)
- Record
SUSE-SU-2023:3858-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:4051-1 No score
Security update for gsl
This update for gsl fixes the following issues:
- CVE-2020-35357: Fixed a stack out of bounds read in gsl_stats_quantile_from_sorted_data(). (bsc#1214681)
- Record
SUSE-SU-2023:4051-1- Updated
- 2026-11-02
OSVUSN-6472-1 No score
gsl vulnerability
It was discovered that GNU Scientific Library incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
- Record
USN-6472-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gslAzure Linux:2 |
through 2.6-3 | None known |
gslAzure Linux:3 |
before 2.8-1 | 2.8-1 |
gslDebian:12 |
before 2.7.1+dfsg-5+deb12u1, plus listed versions 2.7.1+dfsg-5 |
2.7.1+dfsg-5+deb12u1 |
gslDebian:13 |
before 2.7.1+dfsg-6 | 2.7.1+dfsg-6 |
gslDebian:14 |
before 2.7.1+dfsg-6 | 2.7.1+dfsg-6 |
gslDebian:10 |
before 2.5+dfsg-6+deb10u1, plus listed versions 2.5+dfsg-6 |
2.5+dfsg-6+deb10u1 |
gslDebian:11 |
before 2.6+dfsg-2+deb11u1, plus listed versions 2.6+dfsg-2 |
2.6+dfsg-2+deb11u1 |
gslSUSE:Linux Enterprise Workstation Extension 15 SP4 |
before 2.4-150100.9.4.1 | 2.4-150100.9.4.1 |
gslSUSE:Linux Enterprise Workstation Extension 15 SP5 |
before 2.4-150100.9.4.1 | 2.4-150100.9.4.1 |
gslopenSUSE:Leap 15.4 |
before 2.4-150100.9.4.1 | 2.4-150100.9.4.1 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gsl_2_4-gnu-hpcopenSUSE:Leap 15.4 |
before 2.4-150100.9.4.1 | 2.4-150100.9.4.1 |
gsl_2_4-gnu-hpcopenSUSE:Leap 15.5 |
before 2.4-150100.9.4.1 | 2.4-150100.9.4.1 |
gslSUSE:Linux Enterprise Module for Desktop Applications 15 SP4 |
before 2.6-150200.3.4.3 | 2.6-150200.3.4.3 |
gslSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 |
before 2.6-150200.3.4.3 | 2.6-150200.3.4.3 |
gslSUSE:Linux Enterprise Module for Package Hub 15 SP4 |
before 2.6-150200.3.4.3 | 2.6-150200.3.4.3 |
gslSUSE:Linux Enterprise Module for Package Hub 15 SP5 |
before 2.6-150200.3.4.3 | 2.6-150200.3.4.3 |
gslopenSUSE:Leap 15.4 |
before 2.6-150200.3.4.3 | 2.6-150200.3.4.3 |
gsl_2_6-gnu-hpcopenSUSE:Leap 15.4 |
before 2.6-150200.3.4.3 | 2.6-150200.3.4.3 |
gslopenSUSE:Leap 15.5 |
before 2.6-150200.3.4.3 | 2.6-150200.3.4.3 |
gsl_2_6-gnu-hpcopenSUSE:Leap 15.5 |
before 2.6-150200.3.4.3 | 2.6-150200.3.4.3 |
gslSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 1.16-5.4.1 | 1.16-5.4.1 |
gslSUSE:Linux Enterprise Workstation Extension 12 SP5 |
before 1.16-5.4.1 | 1.16-5.4.1 |
gslUbuntu:Pro:16.04:LTS |
before 2.1+dfsg-2ubuntu0.1~esm1, plus listed versions 1.16+dfsg-42.0+dfsg-1ubuntu12.1+dfsg-2 |
2.1+dfsg-2ubuntu0.1~esm1 |
gslUbuntu:Pro:18.04:LTS |
before 2.4+dfsg-6ubuntu0.1~esm1, plus listed versions 2.4+dfsg-6 |
2.4+dfsg-6ubuntu0.1~esm1 |
gslUbuntu:20.04:LTS |
before 2.5+dfsg-6+deb10u1build0.20.04.1, plus listed versions 2.5+dfsg-62.5+dfsg-6build1 |
2.5+dfsg-6+deb10u1build0.20.04.1 |
gslUbuntu:Pro:22.04:LTS |
before 2.7.1+dfsg-3ubuntu0.22.04.1~esm1, plus listed versions 2.6+dfsg-22.7.1+dfsg-3 |
2.7.1+dfsg-3ubuntu0.22.04.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-35357 is a medium vulnerability (CVSS 6.5) in Gnu Scientific Library, published August 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 61st percentile. Fixed in gsl 2.8-1.
References
savannah.gnu.org/bugs?59624
git.savannah.gnu.org/cgit/gsl.git/commit?id=989a193268b963aa1047814f7f1402084fb7d859
lists.debian.org/debian-lts-announce/2023/09/msg00023.html
nvd.nist.gov/vuln/detail/CVE-2020-35357
github.com/advisories/GHSA-xp4h-43w8-c7qr
Show 9 moreShow less
security-tracker.debian.org/tracker/CVE-2020-35357
suse.com/support/update/announcement/2023/suse-su-20233527-1
bugzilla.suse.com/1214681
ubuntu.com/security/CVE-2020-35357
cve.org/CVERecord?id=CVE-2020-35357