CVE-2020-1752: glibc before 2.32.0 (exclusive), Affected: versions 2.14 and later, Fixed: version 2.32; +10 more affected products

Affected technology

glibc · before 2.32.0 (exclusive)
gnu

ubuntu linux · 16.04
canonical

ubuntu linux · 18.04
canonical

ubuntu linux · 19.10
canonical

active iq unified manager · from 9.5 (inclusive)
netapp

hci management node · Version not applicable in the source CPE
netapp

solidfire · Version not applicable in the source CPE
netapp

steelstore cloud integrated storage · Version not applicable in the source CPE
netapp

h410c firmware · Version not applicable in the source CPE
netapp

debian linux · 10.0
debian

glibc · Affected: versions 2.14 and later, Fixed: version 2.32
GNU Libc

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · V3.1.0 to before V3.1.5
Siemens

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · V3.1.0 to before V3.1.5
Siemens

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · V3.1.0 to before V3.1.5
Siemens

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · No privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Local · No privileges required · User interaction required

What an attacker can do

A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. Vendor/CNA’s CVSS 3.1 assessment (base score 7.0/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 7.0/10) rates confidentiality, integrity and availability impact as high.