CVE-2020-36148
Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1...
CVE-2020-36148 is a medium vulnerability (CVSS 6.5) in Symonics Libmysofa, published February 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.17%, the 67th percentile. Fixed in libmysofa 1.2~dfsg0-1.
Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).
- Record
CVE-2020-36148- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).
- Record
CVE-2020-36148- Updated
- 2026-11-02
EUVDEUVD-2020-23726 No score
Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).
- Record
EUVD-2020-23726- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2r9h-7mx9-fq3w No score
Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1...
Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).
- Record
GHSA-2r9h-7mx9-fq3w- Weakness
- CWE-476
- Updated
- 2026-11-02
OSV
Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).
- Record
CVE-2020-36148- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-36148
Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).
- Record
DEBIAN-CVE-2020-36148- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2020-36148
Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).
- Record
UBUNTU-CVE-2020-36148- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0444-1 No score
Security update for libmysofa
This update for libmysofa fixes the following issues:
- Added security backports: gh#hoene/libmysofa#136 - CVE-2020-36152 - boo#1181977 gh#hoene/libmysofa#138 - CVE-2020-36148 - boo#1181981 gh#hoene/libmysofa#137 - CVE-2020-36149 - boo#1181980 gh#hoene/libmysofa#134 - CVE-2020-36151 - boo#1181978 gh#hoene/libmysofa#135 - CVE-2020-36150 - boo#1181979 gh#hoene/libmysofa#96 - CVE-2020-6860 - boo#1182883
Update to version 0.9.1
- Extended angular neighbor search to 'close the sphere'
- Added and exposed mysofa_getfilter_float_nointerp method
- Fixed various security issues CVE-2019-16091 - boo#1149919 CVE-2019-16092 - boo#1149920 CVE-2019-16093 - boo#1149922 CVE-2019-16094 - boo#1149924 CVE-2019-16095 - boo#1149926 CVE-2019-20016 - boo#1159839 CVE-2019-20063 - boo#1160040
- Record
openSUSE-SU-2021:0444-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0459-1 No score
Security update for libmysofa
This update for libmysofa fixes the following issues:
- Added security backports: gh#hoene/libmysofa#136 - CVE-2020-36152 - boo#1181977 gh#hoene/libmysofa#138 - CVE-2020-36148 - boo#1181981 gh#hoene/libmysofa#137 - CVE-2020-36149 - boo#1181980 gh#hoene/libmysofa#134 - CVE-2020-36151 - boo#1181978 gh#hoene/libmysofa#135 - CVE-2020-36150 - boo#1181979 gh#hoene/libmysofa#96 - CVE-2020-6860 - boo#1182883
Update to version 0.9.1
- Extended angular neighbor search to 'close the sphere'
- Added and exposed mysofa_getfilter_float_nointerp method
- Fixed various security issues CVE-2019-16091 - boo#1149919 CVE-2019-16092 - boo#1149920 CVE-2019-16093 - boo#1149922 CVE-2019-16094 - boo#1149924 CVE-2019-16095 - boo#1149926 CVE-2019-20016 - boo#1159839 CVE-2019-20063 - boo#1160040
This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2021:0459-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10960-1 No score
libmysofa-devel-1.2-1.3 on GA media
These are all security issues fixed in the libmysofa-devel-1.2-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10960-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libmysofaDebian:12 |
before 1.2~dfsg0-1 | 1.2~dfsg0-1 |
libmysofaDebian:13 |
before 1.2~dfsg0-1 | 1.2~dfsg0-1 |
libmysofaDebian:14 |
before 1.2~dfsg0-1 | 1.2~dfsg0-1 |
libmysofaUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.6~dfsg0-10.6~dfsg0-20.6~dfsg0-2ubuntu0.18.04.10.6~dfsg0-3+deb10u1build10.6~dfsg0-3+deb10u1ubuntu0.1~esm1 |
None known |
libmysofaUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 0.7~dfsg0-10.8~dfsg0-10.9~dfsg0-10.9.1~dfsg0-11.0~dfsg0-11.0~dfsg0-1ubuntu0.1~esm1 |
None known |
libmysofaUbuntu:22.04:LTS |
before 1.2~dfsg0-1 | 1.2~dfsg0-1 |
libmysofaopenSUSE:Leap 15.2 |
before 0.9.1-lp152.3.3.1 | 0.9.1-lp152.3.3.1 |
libmysofaSUSE:Package Hub 15 SP2 |
before 0.9.1-bp152.4.3.1 | 0.9.1-bp152.4.3.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/hoene/libmysofa/issues/138
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQLNZOVVONQSZZJHQVZT6NMOUUDMGBBR
nvd.nist.gov/vuln/detail/CVE-2020-36148
security-tracker.debian.org/tracker/CVE-2020-36148
Show 31 moreShow less
ubuntu.com/security/CVE-2020-36148
cve.org/CVERecord?id=CVE-2020-36148
lists.opensuse.org/archives/list/[email protected]/thread/UFAOL5LVMXJXRBU3JU2LMHQNMBUBR7BH
bugzilla.suse.com/1149919
suse.com/security/cve/CVE-2019-16091