CVE-2020-36152

Buffer overflow in readDataVar in hdf/dataobject.c in Symonics libmysofa 0.5 - 1.1 allows...

8.8 HighFix available

CVE-2020-36152 is a high vulnerability (CVSS 8.8) in Symonics Libmysofa, published February 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.37%, the 83rd percentile. Fixed in libmysofa 1.2~dfsg0-1.

Buffer overflow in readDataVar in hdf/dataobject.c in Symonics libmysofa 0.5 - 1.1 allows attackers to execute arbitrary code via a crafted SOFA.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.37%Up 1.3 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

Buffer overflow in readDataVar in hdf/dataobject.c in Symonics libmysofa 0.5 - 1.1 allows attackers to execute arbitrary code via a crafted SOFA.

Record: CVE-2020-36152
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-120
Updated: 2026-11-02

CVE List No score

Buffer overflow in readDataVar in hdf/dataobject.c in Symonics libmysofa 0.5 - 1.1 allows attackers to execute arbitrary code via a crafted SOFA.

Record: CVE-2020-36152
Updated: 2026-11-02

EUVDEUVD-2020-23730 No score

Buffer overflow in readDataVar in hdf/dataobject.c in Symonics libmysofa 0.5 - 1.1 allows attackers to execute arbitrary code via a crafted SOFA.

Record: EUVD-2020-23730
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rcr6-jvpg-rgxq No score

Buffer overflow in readDataVar in hdf/dataobject.c in Symonics libmysofa 0.5 - 1.1 allows...

Buffer overflow in readDataVar in hdf/dataobject.c in Symonics libmysofa 0.5 - 1.1 allows attackers to execute arbitrary code via a crafted SOFA.

Record: GHSA-rcr6-jvpg-rgxq
Weakness: CWE-120
Updated: 2026-11-02

OSV 8.8

Buffer overflow in readDataVar in hdf/dataobject.c in Symonics libmysofa 0.5 - 1.1 allows attackers to execute arbitrary code via a crafted SOFA.

Record: CVE-2020-36152
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2020-36152 8.8

Buffer overflow in readDataVar in hdf/dataobject.c in Symonics libmysofa 0.5 - 1.1 allows attackers to execute arbitrary code via a crafted SOFA.

Record: DEBIAN-CVE-2020-36152
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVUBUNTU-CVE-2020-36152 8.8

Buffer overflow in readDataVar in hdf/dataobject.c in Symonics libmysofa 0.5 - 1.1 allows attackers to execute arbitrary code via a crafted SOFA.

Record: UBUNTU-CVE-2020-36152
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2021:0444-1 No score

Security update for libmysofa

This update for libmysofa fixes the following issues:

Added security backports: gh#hoene/libmysofa#136 - CVE-2020-36152 - boo#1181977 gh#hoene/libmysofa#138 - CVE-2020-36148 - boo#1181981 gh#hoene/libmysofa#137 - CVE-2020-36149 - boo#1181980 gh#hoene/libmysofa#134 - CVE-2020-36151 - boo#1181978 gh#hoene/libmysofa#135 - CVE-2020-36150 - boo#1181979 gh#hoene/libmysofa#96 - CVE-2020-6860 - boo#1182883

Update to version 0.9.1

Extended angular neighbor search to 'close the sphere'
Added and exposed mysofa_getfilter_float_nointerp method
Fixed various security issues CVE-2019-16091 - boo#1149919 CVE-2019-16092 - boo#1149920 CVE-2019-16093 - boo#1149922 CVE-2019-16094 - boo#1149924 CVE-2019-16095 - boo#1149926 CVE-2019-20016 - boo#1159839 CVE-2019-20063 - boo#1160040

Record: openSUSE-SU-2021:0444-1
Updated: 2026-11-02

OSVopenSUSE-SU-2021:0459-1 No score

Security update for libmysofa

This update for libmysofa fixes the following issues:

Added security backports: gh#hoene/libmysofa#136 - CVE-2020-36152 - boo#1181977 gh#hoene/libmysofa#138 - CVE-2020-36148 - boo#1181981 gh#hoene/libmysofa#137 - CVE-2020-36149 - boo#1181980 gh#hoene/libmysofa#134 - CVE-2020-36151 - boo#1181978 gh#hoene/libmysofa#135 - CVE-2020-36150 - boo#1181979 gh#hoene/libmysofa#96 - CVE-2020-6860 - boo#1182883

Update to version 0.9.1

Extended angular neighbor search to 'close the sphere'
Added and exposed mysofa_getfilter_float_nointerp method
Fixed various security issues CVE-2019-16091 - boo#1149919 CVE-2019-16092 - boo#1149920 CVE-2019-16093 - boo#1149922 CVE-2019-16094 - boo#1149924 CVE-2019-16095 - boo#1149926 CVE-2019-20016 - boo#1159839 CVE-2019-20063 - boo#1160040

This update was imported from the openSUSE:Leap:15.2:Update update project.

Record: openSUSE-SU-2021:0459-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10960-1 No score

libmysofa-devel-1.2-1.3 on GA media

These are all security issues fixed in the libmysofa-devel-1.2-1.3 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10960-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libmysofa` Debian:12	before 1.2~dfsg0-1	1.2~dfsg0-1
`libmysofa` Debian:13	before 1.2~dfsg0-1	1.2~dfsg0-1
`libmysofa` Debian:14	before 1.2~dfsg0-1	1.2~dfsg0-1
`libmysofa` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 0.6~dfsg0-10.6~dfsg0-20.6~dfsg0-2ubuntu0.18.04.10.6~dfsg0-3+deb10u1build10.6~dfsg0-3+deb10u1ubuntu0.1~esm1	None known
`libmysofa` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 0.7~dfsg0-10.8~dfsg0-10.9~dfsg0-10.9.1~dfsg0-11.0~dfsg0-11.0~dfsg0-1ubuntu0.1~esm1	None known
`libmysofa` Ubuntu:22.04:LTS	before 1.2~dfsg0-1	1.2~dfsg0-1
`libmysofa` openSUSE:Leap 15.2	before 0.9.1-lp152.3.3.1	0.9.1-lp152.3.3.1
`libmysofa` SUSE:Package Hub 15 SP2	before 0.9.1-bp152.4.3.1	0.9.1-bp152.4.3.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 31 moreShow less