CVE-2020-29394

NameCVE-2020-29394
DescriptionA buffer overflow in the dlt_filter_load function in dlt_common.c from dlt-daemon through 2.18.5 (GENIVI Diagnostic Log and Trace) allows arbitrary code execution because fscanf is misused (no limit on the number of characters to be read in the format argument).
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs976228

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
dlt-daemon (PTS)buster2.18.0-1vulnerable
bullseye2.18.6-1fixed
sid2.18.6-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
dlt-daemonsource(unstable)2.18.5-0.3976228

Notes

[buster] - dlt-daemon <no-dsa> (Minor issue)
https://github.com/GENIVI/dlt-daemon/issues/274
https://github.com/GENIVI/dlt-daemon/pull/275
https://github.com/GENIVI/dlt-daemon/commit/ff4f44c159df6f44b48bd38c9d2f104eb360be11

Search for package or bug name: Reporting problems