{"id":"CVE-2019-20367","title":"nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).","summary":"nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cwe":["CWE-125"],"vendor":"freedesktop","product":"libbsd","affected":["libbsd < 0.10.0","debian_linux = 9.0","ubuntu_linux = 12.04","ubuntu_linux = 14.04","ubuntu_linux = 16.04","ubuntu_linux = 18.04","ubuntu_linux = 19.04","leap = 15.1"],"patched":["libbsd 0.10.0"],"published":"2020-01-08","updated":"2026-10-14","sourceUpdated":"2026-10-14T08:17:00.940","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-20367","references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00043.html","label":"cve@mitre.org"},{"url":"https://gitlab.freedesktop.org/libbsd/libbsd/commit/9d917aad37778a9f4a96ba358415f077f3f36f3b","label":"cve@mitre.org"},{"url":"https://lists.apache.org/thread.html/r0e913668380f59bcbd14fdd8ae8d24f95f99995e290cd18a7822c6e5%40%3Cdev.tomee.apache.org%3E","label":"cve@mitre.org"},{"url":"https://lists.apache.org/thread.html/ra781e51cf1ec40381c98cddc073b3576fb56c3978f4564d2fa431550%40%3Cdev.tomee.apache.org%3E","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2021/02/msg00027.html","label":"cve@mitre.org"},{"url":"https://lists.freedesktop.org/archives/libbsd/2019-August/000229.html","label":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/4243-1/","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00043.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://gitlab.freedesktop.org/libbsd/libbsd/commit/9d917aad37778a9f4a96ba358415f077f3f36f3b","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r0e913668380f59bcbd14fdd8ae8d24f95f99995e290cd18a7822c6e5%40%3Cdev.tomee.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/ra781e51cf1ec40381c98cddc073b3576fb56c3978f4564d2fa431550%40%3Cdev.tomee.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2021/02/msg00027.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.freedesktop.org/archives/libbsd/2019-August/000229.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4243-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.02805,"epssPercentile":0.86143,"ingestedAt":"2026-10-14T08:23:04.329Z","slug":"CVE-2019-20367","body":"## Overview\n\nnlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).\n\n## Affected\n\n- `libbsd < 0.10.0`\n- `debian_linux = 9.0`\n- `ubuntu_linux = 12.04`\n- `ubuntu_linux = 14.04`\n- `ubuntu_linux = 16.04`\n- `ubuntu_linux = 18.04`\n- `ubuntu_linux = 19.04`\n- `leap = 15.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `libbsd 0.10.0`","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":50.1,"likelihood":0.6,"exploitation":0,"ransomware":0},"changes":[]}