{"id":"CVE-2020-36148","aliases":["DEBIAN-CVE-2020-36148","EUVD-2020-23726","GHSA-2r9h-7mx9-fq3w","UBUNTU-CVE-2020-36148","openSUSE-SU-2021:0444-1","openSUSE-SU-2021:0459-1","openSUSE-SU-2024:10960-1"],"status":"published","title":"Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1...","description":"Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01168,"percentile":0.67772,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2021-02-08T20:13:35Z","modified":"2026-10-26T12:02:01Z","fixes":[{"ecosystem":"Debian:12","package":"libmysofa","fixed_in":["1.2~dfsg0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libmysofa","fixed_in":["1.2~dfsg0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libmysofa","fixed_in":["1.2~dfsg0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libmysofa","fixed_in":["1.2~dfsg0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libmysofa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2~dfsg0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libmysofa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2~dfsg0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libmysofa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2~dfsg0-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libmysofa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6~dfsg0-1","0.6~dfsg0-2","0.6~dfsg0-2ubuntu0.18.04.1","0.6~dfsg0-3+deb10u1build1","0.6~dfsg0-3+deb10u1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libmysofa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7~dfsg0-1","0.8~dfsg0-1","0.9~dfsg0-1","0.9.1~dfsg0-1","1.0~dfsg0-1","1.0~dfsg0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libmysofa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2~dfsg0-1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"libmysofa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-lp152.3.3.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"libmysofa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-bp152.4.3.1"}]}],"bundled":13}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"symonics","product":"libmysofa"}],"references":[{"url":"https://github.com/hoene/libmysofa/issues/138","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQLNZOVVONQSZZJHQVZT6NMOUUDMGBBR/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36148"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQLNZOVVONQSZZJHQVZT6NMOUUDMGBBR/"},{"url":"https://github.com/advisories/GHSA-2r9h-7mx9-fq3w"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-36148","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-36148","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-36148","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UFAOL5LVMXJXRBU3JU2LMHQNMBUBR7BH/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1149919","tags":["report"]},{"url":"https://bugzilla.suse.com/1149920","tags":["report"]},{"url":"https://bugzilla.suse.com/1149922","tags":["report"]},{"url":"https://bugzilla.suse.com/1149924","tags":["report"]},{"url":"https://bugzilla.suse.com/1149926","tags":["report"]},{"url":"https://bugzilla.suse.com/1159839","tags":["report"]},{"url":"https://bugzilla.suse.com/1160040","tags":["report"]},{"url":"https://bugzilla.suse.com/1181977","tags":["report"]},{"url":"https://bugzilla.suse.com/1181978","tags":["report"]},{"url":"https://bugzilla.suse.com/1181979","tags":["report"]},{"url":"https://bugzilla.suse.com/1181980","tags":["report"]},{"url":"https://bugzilla.suse.com/1181981","tags":["report"]},{"url":"https://bugzilla.suse.com/1182883","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6860","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MN6725XH7QNBYEUP2ZXR5TYK6FD6RGXR/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10672","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-36148","description":"Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).","status":"published","published":"2021-02-08T20:13:35Z","modified":"2024-08-04T17:23:09.359Z","updated_at":"2026-11-02T14:35:54.80237Z"}],"euvd":[{"id":"EUVD-2020-23726","description":"Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).","status":"published","published":"2021-02-08T20:13:35Z","modified":"2024-08-04T17:23:09Z","updated_at":"2026-11-03T03:07:04.065361Z"}],"ghsa":[{"id":"GHSA-2r9h-7mx9-fq3w","title":"Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1...","description":"Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).","status":"published","published":"2022-05-24T17:41:17Z","modified":"2023-01-29T05:05:16Z","cwes":["CWE-476"],"updated_at":"2026-11-02T14:45:45.423268Z"}],"nvd":[{"id":"CVE-2020-36148","description":"Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).","status":"published","published":"2021-02-08T21:15:13.07Z","modified":"2026-06-17T03:14:50.543Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:06:34.188486Z"}],"osv":[{"id":"CVE-2020-36148","description":"Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).","status":"published","published":"2021-02-08T21:15:13.07Z","modified":"2026-11-10T02:30:27.300952729Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-10T02:45:59.319571Z"},{"id":"DEBIAN-CVE-2020-36148","description":"Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).","status":"published","published":"2021-02-08T21:15:13.07Z","modified":"2026-10-26T12:02:01.642913403Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"UBUNTU-CVE-2020-36148","description":"Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).","status":"published","published":"2021-02-08T21:15:00Z","modified":"2026-04-22T12:41:17.210092Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:25.179924Z"},{"id":"openSUSE-SU-2021:0444-1","title":"Security update for libmysofa","description":"This update for libmysofa fixes the following issues:\n\n- Added security backports:\n    gh#hoene/libmysofa#136 - CVE-2020-36152 - boo#1181977\n    gh#hoene/libmysofa#138 - CVE-2020-36148 - boo#1181981\n    gh#hoene/libmysofa#137 - CVE-2020-36149 - boo#1181980\n    gh#hoene/libmysofa#134 - CVE-2020-36151 - boo#1181978\n    gh#hoene/libmysofa#135 - CVE-2020-36150 - boo#1181979\n    gh#hoene/libmysofa#96 - CVE-2020-6860 - boo#1182883\n\nUpdate to version 0.9.1\n\n  * Extended angular neighbor search to 'close the sphere'\n  * Added and exposed mysofa_getfilter_float_nointerp method\n  * Fixed various security issues\n    CVE-2019-16091 - boo#1149919\n    CVE-2019-16092 - boo#1149920\n    CVE-2019-16093 - boo#1149922\n    CVE-2019-16094 - boo#1149924\n    CVE-2019-16095 - boo#1149926\n    CVE-2019-20016 - boo#1159839\n    CVE-2019-20063 - boo#1160040\n","status":"published","published":"2021-03-18T13:07:08Z","modified":"2026-02-04T04:00:56.801588Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0459-1","title":"Security update for libmysofa","description":"This update for libmysofa fixes the following issues:\n\n- Added security backports:\n    gh#hoene/libmysofa#136 - CVE-2020-36152 - boo#1181977\n    gh#hoene/libmysofa#138 - CVE-2020-36148 - boo#1181981\n    gh#hoene/libmysofa#137 - CVE-2020-36149 - boo#1181980\n    gh#hoene/libmysofa#134 - CVE-2020-36151 - boo#1181978\n    gh#hoene/libmysofa#135 - CVE-2020-36150 - boo#1181979\n    gh#hoene/libmysofa#96 - CVE-2020-6860 - boo#1182883\n\nUpdate to version 0.9.1\n\n  * Extended angular neighbor search to 'close the sphere'\n  * Added and exposed mysofa_getfilter_float_nointerp method\n  * Fixed various security issues\n    CVE-2019-16091 - boo#1149919\n    CVE-2019-16092 - boo#1149920\n    CVE-2019-16093 - boo#1149922\n    CVE-2019-16094 - boo#1149924\n    CVE-2019-16095 - boo#1149926\n    CVE-2019-20016 - boo#1159839\n    CVE-2019-20063 - boo#1160040\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-03-21T23:09:29Z","modified":"2026-02-04T02:20:41.995541Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10960-1","title":"libmysofa-devel-1.2-1.3 on GA media","description":"These are all security issues fixed in the libmysofa-devel-1.2-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:19:30.7361Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}