CVE-2020-35357

Summary

CVE	CVE-2020-35357
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-08-22 19:16:00 UTC
Updated	2023-10-11 16:12:00 UTC
Description	A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.

Problem Types: CWE-120

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Debian	Debian Linux	10.0	All	All	All
Application	Gnu	Gnu Scientific Library	2.5	All	All	All
Application	Gnu	Gnu Scientific Library	2.6	All	All	All

Reference	Source	Link	Tags
GNU Scientific Library - Bugs: bug #59624, Buffer overflow in... [Savannah]	MISC	savannah.gnu.org
[SECURITY] [DLA 3576-1] gsl security update	MLIST	lists.debian.org
gsl.git - GNU Scientific Library	MISC	git.savannah.gnu.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

199911 Ubuntu Security Notification for GNU Scientific Library Vulnerability (USN-6472-1)
356109 Amazon Linux Security Advisory for gsl : ALAS2023-2023-353
356149 Amazon Linux Security Advisory for gsl : ALAS2-2023-2255
356360 Amazon Linux Security Advisory for gsl : ALAS-2023-1851
6000072 Debian Security Update for gsl (DLA 3576-1)
754986 SUSE Enterprise Linux Security Update for gsl (SUSE-SU-2023:3858-1)
755073 SUSE Enterprise Linux Security Update for gsl (SUSE-SU-2023:4051-1)