CVE-2020-14311

MediumCVSS 6.0/10Last modified Jun 17, 2026

Description

There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT32_MAX causes an arithmetic overflow leading to a zero-sized memory allocation with subsequent heap-based buffer overflow.

Metrics

CVSS 3.1 6.0/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-122CWE-190

Affected software

No affected versions have been published.

Timeline

Published
Jul 31, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-143125.9A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat EnterpriseCVE-2020-143134.3An information disclosure vulnerability was found in Red Hat Quay in versions before 3.3.1. This flaw allows an attacker who can create a buCVE-2020-143145.5A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a direcCVE-2020-143159.8A memory corruption vulnerability is present in bspatch as shipped in Colin Percival’s bsdiff tools version 4.3. Insufficient checks when haCVE-2020-143169.9A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances (VMIs) can be used to gain access to the host's filesystem. SuccessCVE-2020-143175.5It was found that the issue for security flaw CVE-2019-3805 appeared again in a further version of JBoss Enterprise Application Platform - CCVE-2020-143184.3A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certaiCVE-2020-143195.9It was found that the AMQ Online console is vulnerable to a Cross-Site Request Forgery (CSRF) which is exploitable in cases where preflight CVE-2020-14324.3An information disclosure vulnerability exists when Skype for Business is accessed via Internet Explorer, aka 'Skype for Business via InternCVE-2020-143206.1In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk.CVE-2020-143218.8In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.CVE-2020-143227.5In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, yui_combo needed to limit the amount of files it can load to help mitigate the risk of deni