CVE-2020-29394
dlt-daemon - security update
7.8
HIGH
CVSS 3.1
EPSS 1.4%
Description
A buffer overflow in the dlt_filter_load function in dlt_common.c from dlt-daemon through 2.18.5 (GENIVI Diagnostic Log and Trace) allows arbitrary code execution because fscanf is misused (no limit on the number of characters to be read in the format argument).
How to fix CVE-2020-29394
To remediate CVE-2020-29394, upgrade the affected package to a fixed version below.
- Debian/dlt-daemon—upgrade to 2.18.5-0.3 or later
- —upgrade to 2.18.0-1+deb10u1 or later
Is CVE-2020-29394 being exploited?
Low — EPSS is 1.4%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 2.18.5-0.3
- from 0, < 2.18.0-1+deb10u1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |