CVE-2020-17361

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An issue was discovered in ReadyTalk Avian 1.2.0. The vm::arrayCopy method defined in classpath-common.h returns silently when a negative length is provided (instead of throwing an exception). This could result in data being lost during the copy, with varying consequences depending on the subsequent use of the destination buffer. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-755

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2020/Aug/10Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Sep/11Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Sep/13Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Sep/14Mailing List, Third Party Advisory
https://github.com/ReadyTalk/avian/issuesThird Party Advisory
http://seclists.org/fulldisclosure/2020/Aug/10Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Sep/11Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Sep/13Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Sep/14Mailing List, Third Party Advisory
https://github.com/ReadyTalk/avian/issuesThird Party Advisory

Timeline

Published: Aug 12, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-173626.1search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS.CVE-2020-173639.9USVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters in the number_start or number_end parameter CVE-2020-173646.1USVN (aka User-friendly SVN) before 1.0.9 allows XSS via SVN logs.CVE-2020-173657.8Improper directory permissions in the Hotspot Shield VPN client software for Windows 10.3.0 and earlier may allow an authorized user to pote CVE-2020-173667.4An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1. It allows remote attackers to bypass intended access restrictions or t CVE-2020-173677.8Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to command injection.CVE-2020-173689.8Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command inje CVE-2020-17377.8A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip mo CVE-2020-173725.4SugarCRM before 10.1.0 (Q3 2020) allows XSS.CVE-2020-173735.3SugarCRM before 10.1.0 (Q3 2020) allows SQL Injection.CVE-2020-173768.3An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By perfor CVE-2020-17383.9A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task i