Every CVE Search/ Get API key

CVE-2020-27350

apt integer wraparound

5.7 MediumFix available

APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.38%Down 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 5.7

apt integer wraparound

APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;

Record
CVE-2020-27350
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2020-19862 5.7

APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;

Record
EUVD-2020-19862
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-j2wg-wfjw-m5cq 5.7

APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168...

APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;

Record
GHSA-j2wg-wfjw-m5cq
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-190
Updated
2026-11-02
NVD 5.7

APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;

Record
CVE-2020-27350
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-190
Updated
2026-11-02
OSV 5.7

APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;

Record
CVE-2020-27350
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2020-27350 5.7

APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;

Record
DEBIAN-CVE-2020-27350
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2020-27350 5.7

APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;

Record
UBUNTU-CVE-2020-27350
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVUSN-4667-1 No score

apt vulnerability

Kevin Backhouse discovered that APT incorrectly handled certain packages. A local attacker could possibly use this issue to cause APT to crash or stop responding, resulting in a denial of service.

Record
USN-4667-1
Updated
2026-11-02
OSVUSN-4667-2 No score

apt vulnerability

USN-4667-1 fixed a vulnerability in APT. This update provides the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

Kevin Backhouse discovered that APT incorrectly handled certain packages. A local attacker could possibly use this issue to cause APT to crash or stop responding, resulting in a denial of service.

Record
USN-4667-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apt
Debian:12
 before 2.1.13
2.1.13
apt
Debian:13
 before 2.1.13
2.1.13
apt
Debian:14
 before 2.1.13
2.1.13
apt
Debian:9
 before 1.4.11, plus listed versions
1.4.101.4.61.4.71.4.81.4.9
1.4.11
apt
Debian:10
 before 1.8.2.2, plus listed versions
1.8.21.8.2.1
1.8.2.2
apt
Ubuntu:Pro:14.04:LTS
 before 1.0.1ubuntu2.24+esm3, plus listed versions
0.9.9.1~ubuntu30.9.9.1~ubuntu40.9.9.1~ubuntu50.9.13~exp1ubuntu10.9.13~exp1ubuntu2
Show 33 moreShow less
0.9.13~exp1ubuntu30.9.13.1~ubuntu10.9.14.1ubuntu10.9.14.1ubuntu20.9.15.1ubuntu10.9.15.4ubuntu10.9.15.4ubuntu20.9.15.4ubuntu30.9.15.4ubuntu40.9.15.4ubuntu51.0.1ubuntu21.0.1ubuntu2.11.0.1ubuntu2.31.0.1ubuntu2.4.11.0.1ubuntu2.51.0.1ubuntu2.61.0.1ubuntu2.71.0.1ubuntu2.81.0.1ubuntu2.91.0.1ubuntu2.101.0.1ubuntu2.111.0.1ubuntu2.121.0.1ubuntu2.131.0.1ubuntu2.141.0.1ubuntu2.151.0.1ubuntu2.171.0.1ubuntu2.181.0.1ubuntu2.191.0.1ubuntu2.201.0.1ubuntu2.221.0.1ubuntu2.231.0.1ubuntu2.241.0.1ubuntu2.24+esm1
1.0.1ubuntu2.24+esm3
apt
Ubuntu:16.04:LTS
 before 1.2.32ubuntu0.2, plus listed versions
1.0.10.2ubuntu11.1.41.1.51.1.101.2.3
Show 22 moreShow less
1.2.41.2.61.2.71.2.81.2.91.2.101.2.10ubuntu11.2.12~ubuntu16.04.11.2.151.2.15ubuntu0.21.2.181.2.191.2.201.2.241.2.251.2.261.2.271.2.291.2.29ubuntu0.11.2.311.2.321.2.32ubuntu0.1
1.2.32ubuntu0.2
apt
Ubuntu:18.04:LTS
 before 1.6.12ubuntu0.2, plus listed versions
1.51.5.11.6~alpha51.6~alpha7ubuntu11.6~alpha7ubuntu2
Show 14 moreShow less
1.6~beta11.6~rc11.61.6.11.6.21.6.31.6.3ubuntu0.11.6.61.6.6ubuntu0.11.6.81.6.101.6.111.6.121.6.12ubuntu0.1
1.6.12ubuntu0.2
apt
Ubuntu:20.04:LTS
 before 2.0.2ubuntu0.2, plus listed versions
1.9.41.9.51.9.71.9.81.9.9
Show 6 moreShow less
1.9.102.0.02.0.12.0.1ubuntu12.0.22.0.2ubuntu0.1
2.0.2ubuntu0.2

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-27350 is a medium vulnerability (CVSS 5.7) in Canonical Apt, published December 9, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 31st percentile. Fixed in apt 2.1.13.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open