{"api_version":"1","generated_at":"2026-07-23T11:25:39+00:00","cve":"CVE-2020-36148","urls":{"html":"https://cve.report/CVE-2020-36148","api":"https://cve.report/api/cve/CVE-2020-36148.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-36148","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-36148"},"summary":{"title":"CVE-2020-36148","description":"Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2021-02-08 21:15:00","updated_at":"2023-11-07 03:22:00"},"problem_types":["CWE-476"],"metrics":[],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQLNZOVVONQSZZJHQVZT6NMOUUDMGBBR/","name":"FEDORA-2021-4e40ccb5e6","refsource":"","tags":[],"title":"[SECURITY] Fedora 32 Update: libmysofa-1.2-4.fc32 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/hoene/libmysofa/issues/138","name":"https://github.com/hoene/libmysofa/issues/138","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"NULL pointer dereference in verifyAttribute  · Issue #138 · hoene/libmysofa · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQLNZOVVONQSZZJHQVZT6NMOUUDMGBBR/","name":"FEDORA-2021-4e40ccb5e6","refsource":"FEDORA","tags":["Mailing List","Patch","Third Party Advisory"],"title":"[SECURITY] Fedora 32 Update: libmysofa-1.2-4.fc32 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-36148","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36148","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"36148","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"32","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"36148","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"32","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"36148","vulnerable":"1","versionEndIncluding":"1.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"symonics","cpe5":"libmysofa","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2020-36148","qid":"750304","title":"OpenSUSE Security Update for libmysofa (openSUSE-SU-2021:0444-1)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2020-36148","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments)."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://github.com/hoene/libmysofa/issues/138","refsource":"MISC","name":"https://github.com/hoene/libmysofa/issues/138"},{"refsource":"FEDORA","name":"FEDORA-2021-4e40ccb5e6","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQLNZOVVONQSZZJHQVZT6NMOUUDMGBBR/"}]}},"nvd":{"publishedDate":"2021-02-08 21:15:00","lastModifiedDate":"2023-11-07 03:22:00","problem_types":["CWE-476"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:N/A:P","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:symonics:libmysofa:*:*:*:*:*:*:*:*","versionStartIncluding":"0.5","versionEndIncluding":"1.1","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"36148","Ordinal":"196174","Title":"CVE-2020-36148","CVE":"CVE-2020-36148","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"36148","Ordinal":"1","NoteData":"Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).","Type":"Description","Title":null},{"CveYear":"2020","CveId":"36148","Ordinal":"2","NoteData":"2021-02-08","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"36148","Ordinal":"3","NoteData":"2021-02-25","Type":"Other","Title":"Modified"}]}}}