CVE-2020-14147

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow. NOTE: this issue exists because of a CVE-2015-8080 regression.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-190 CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00058.htmlMailing List, Third Party Advisory
https://github.com/antirez/redis/commit/ef764dde1cca2f25d00686673d1bc89448819571Patch, Third Party Advisory
https://github.com/antirez/redis/pull/6875Patch, Third Party Advisory
https://security.gentoo.org/glsa/202008-17Third Party Advisory
https://www.debian.org/security/2020/dsa-4731Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00058.htmlMailing List, Third Party Advisory
https://github.com/antirez/redis/commit/ef764dde1cca2f25d00686673d1bc89448819571Patch, Third Party Advisory
https://github.com/antirez/redis/pull/6875Patch, Third Party Advisory
https://security.gentoo.org/glsa/202008-17Third Party Advisory
https://www.debian.org/security/2020/dsa-4731Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory

Timeline

Published: Jun 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-141487.5The Server-Server protocol implementation in ngIRCd before 26~rc2 allows an out-of-bounds access, as demonstrated by the IRC_NJOIN() functio CVE-2020-141497.5In uftpd before 2.12, handle_CWD in ftpcmd.c mishandled the path provided by the user, causing a NULL pointer dereference and denial of serv CVE-2020-14157.8An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation CVE-2020-141505.5GNU Bison before 3.5.4 allows attackers to cause a denial of service (application crash). NOTE: there is a risk only if Bison is used with u CVE-2020-141527.1In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly caus CVE-2020-141537.1In IJG JPEG (aka libjpeg) from version 8 through 9c, jdhuff.c has an out-of-bounds array read for certain table pointers.CVE-2020-141544.8Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate CVE-2020-141555.3libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.CVE-2020-141568.8user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions CVE-2020-141578.1The wireless-communication feature of the ABUS Secvest FUBE50001 device does not encrypt sensitive data such as PIN codes or IDs of used pro CVE-2020-141589.1The ABUS Secvest FUMO50110 hybrid module does not have any security mechanism that ensures confidentiality or integrity of RF packets that a CVE-2020-141598.8By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications