Unscored CVE-2020-18897 EUVD-2020-10810GHSA-8whc-587x-j3fm

An use-after-free vulnerability in the libpff_item_tree_create_node function of libyal Libpff before 20180623 allows attackers to cause a d…

Published Aug 19, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Package: libpff Package: libpff Ecosystem: Debian Ecosystem: Ubuntu

Description

An use-after-free vulnerability in the libpff_item_tree_create_node function of libyal Libpff before 20180623 allows attackers to cause a denial of service (DOS) or execute arbitrary code via a crafted pff file.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libpff	20180714-1	—
Debian 13	libpff	20180714-1	—
Debian 12	libpff	20180714-1	—

Ubuntu