CVE-2020-35357 is a buffer overflow vulnerability affecting versions 2.5 and 2.6 of the GNU Scientific Library (GSL) Statistics Library, specifically impacting Debian Linux distributions. An unauthenticated attacker could exploit this by providing a specially crafted input to the gsl_stats_quantile_from_sorted_data function, leading to application termination (denial of service) or potentially arbitrary code execution. Rated as Medium severity (CVSS 6.5), this vulnerability requires user interaction (UI:R) to trigger. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.5CPE matchmatch criteria | cpe:2.3:a:gnu:gnu_scientific_library:2.5:*:*:*:*:*:*:* | ||
2.6CPE matchmatch criteria | cpe:2.3:a:gnu:gnu_scientific_library:2.6:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
gsl: Stack buffer overflow in gsl_stats_quantile_from_sorted_data
Aug 22, 2023A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.
Aug 8, 2023