NVD Vulnerability Detail

CVE-2020-11958

Summary	re2c 1.3 has a heap-based buffer overflow in Scanner::fill in parse/scanner.cc via a long lexeme.
Publication Date	April 21, 2020, 10:15 a.m.
Registration Date	Jan. 26, 2021, 11:51 a.m.
Last Update	Nov. 21, 2024, 1:58 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:re2c:re2c:1.3:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:19.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:20.04::::lts:::

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2020/04/21/1	Mailing List Third Party Advisory
2	https://blogs.gentoo.org/ago/2020/04/19/re2c-heap-overflow-in-scannerfill-scanner-cc/	Third Party Advisory
3	https://github.com/skvadrik/re2c/commit/c4603ba5ce229db83a2a4fb93e6d4b4e3ec3776a	Patch Third Party Advisory
4	https://security.gentoo.org/glsa/202007-28	Third Party Advisory
5	https://usn.ubuntu.com/4338-1/	Third Party Advisory
6	https://usn.ubuntu.com/4338-2/	Third Party Advisory
7	https://www.openwall.com/lists/oss-security/2020/04/19/1	Mailing List Third Party Advisory
8	http://www.openwall.com/lists/oss-security/2020/04/21/1	Mailing List Third Party Advisory
9	https://www.openwall.com/lists/oss-security/2020/04/19/1	Mailing List Third Party Advisory
10	https://usn.ubuntu.com/4338-2/	Third Party Advisory
11	https://usn.ubuntu.com/4338-1/	Third Party Advisory
12	https://security.gentoo.org/glsa/202007-28	Third Party Advisory
13	https://github.com/skvadrik/re2c/commit/c4603ba5ce229db83a2a4fb93e6d4b4e3ec3776a	Patch Third Party Advisory
14	https://blogs.gentoo.org/ago/2020/04/19/re2c-heap-overflow-in-scannerfill-scanner-cc/	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-787	境界外書き込み	https://cwe.mitre.org/data/definitions/787.html

JVN Vulnerability Information

re2c における境界外書き込みに関する脆弱性

Title	re2c における境界外書き込みに関する脆弱性
Summary	re2c には、境界外書き込みに関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 18, 2020, midnight
Registration Date	May 27, 2020, 4:44 p.m.
Last Update	May 27, 2020, 4:44 p.m.

Affected System

re2c

re2c 1.3

Canonical

Ubuntu

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-11958	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11958
National Vulnerability Database (NVD)
2	CVE-2020-11958	https://nvd.nist.gov/vuln/detail/CVE-2020-11958

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-787	https://cwe.mitre.org/data/definitions/787.html

ベンダー情報

No	Name	URL
GitHub
1	Fix crash in lexer refill (reported by Agostino Sarubbo).	https://github.com/skvadrik/re2c/commit/c4603ba5ce229db83a2a4fb93e6d4b4e3ec3776a
Ubuntu Security Notice
2	USN-4338-1	https://usn.ubuntu.com/4338-1/
3	USN-4338-2	https://usn.ubuntu.com/4338-2/

Change Log

No	Changed Details	Date of change
1	[2020年05月27日] 掲載	May 27, 2020, 4:44 p.m.