CVE-2020-7450

Published: Feb 18, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r357214, and 11.3-RELEASE before 11.3-RELEASE-p6, URL handling in libfetch with URLs containing username and/or password components is vulnerable to a heap buffer overflow allowing program misbehavior or malicious code execution.

Affected (20)

Products: Freebsd: Freebsd

Freebsd

1 product

Freebsd

Configuration A

20 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 11.3
Freebsd Freebsd	Version 11.3 p1
Freebsd Freebsd	Version 11.3 p2
Freebsd Freebsd	Version 11.3 p3
Freebsd Freebsd	Version 11.3 p4
Freebsd Freebsd	Version 11.3 p5
Freebsd Freebsd	Version 12.0
Freebsd Freebsd	Version 12.0 p10
Freebsd Freebsd	Version 12.0 p11
Freebsd Freebsd	Version 12.0 p12
Freebsd Freebsd	Version 12.0 p1
Freebsd Freebsd	Version 12.0 p2
Freebsd Freebsd	Version 12.0 p3
Freebsd Freebsd	Version 12.0 p4
Freebsd Freebsd	Version 12.0 p6
Freebsd Freebsd	Version 12.0 p7
Freebsd Freebsd	Version 12.0 p8
Freebsd Freebsd	Version 12.0 p9
Freebsd Freebsd	Version 12.1
Freebsd Freebsd	Version 12.1 p1

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (2)

https://security.FreeBSD.org/advisories/FreeBSD-SA-20:01.libfetch.asc

Source: secteam@freebsd.org

PatchVendor Advisory

https://security.FreeBSD.org/advisories/FreeBSD-SA-20:01.libfetch.asc

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.