PYSEC-2020-30

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/bsdiff4/PYSEC-2020-30.yaml
JSON Data
https://api.test.osv.dev/v1/vulns/PYSEC-2020-30
Aliases
Published
2020-07-22T23:15:00Z
Modified
2024-02-23T20:56:46.222600Z
Summary
[none]
Details

A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a crafted patch file.

References

Affected packages

PyPI / bsdiff4

Package

Name
bsdiff4
View open source insights on deps.dev
Purl
pkg:pypi/bsdiff4

Affected ranges

Type
GIT
Repo
https://github.com/ilanschnell/bsdiff4
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
49a4cee2feef7deaf9d89e5e793a8824930284d7
Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.0

Affected versions

1.*

1.0.0
1.0.1
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/bsdiff4/PYSEC-2020-30.yaml"