CVE-2020-24340

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The code that processes DNS responses in pico_mdns_handle_data_as_answers_generic() in pico_mdns.c does not check whether the number of answers/responses specified in a DNS packet header corresponds to the response data available in the packet, leading to an out-of-bounds read, invalid pointer dereference, and Denial-of-Service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01Third Party Advisory, US Government Resource
https://www.kb.cert.org/vuls/id/815128Third Party Advisory, US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01Third Party Advisory, US Government Resource
https://www.kb.cert.org/vuls/id/815128Third Party Advisory, US Government Resource

Timeline

Published: Dec 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-243419.1An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c does not validate the CVE-2020-243427.8Lua through 5.4.0 allows a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls luaD_callnoyield twice in a CVE-2020-243437.8Artifex MuJS through 1.0.7 has a use-after-free in jsrun.c because of unconditional marking in jsgc.c.CVE-2020-243447.1JerryScript through 2.3.0 has a (function({a=arguments}){const arguments}) buffer over-read.CVE-2020-243457.8JerryScript through 2.3.0 allows stack consumption via function a(){new new Proxy(a,{})}JSON.parse("[]",a). NOTE: the vendor states that the CVE-2020-243467.8njs through 0.4.3, used in NGINX, has a use-after-free in njs_json_parse_iterator_call in njs_json.c.CVE-2020-243475.5njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_lvlhsh_level_find in njs_lvlhsh.c.CVE-2020-243485.5njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_json_stringify_iterator in njs_json.c.CVE-2020-243495.5njs through 0.4.3, used in NGINX, allows control-flow hijack in njs_value_property in njs_value.c. NOTE: the vendor considers the issue to b CVE-2020-243525.5An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occu CVE-2020-243536.1Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header.CVE-2020-243548.8Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by shell injection.