CVE-2020-28895

In Wind River VxWorks, memory allocator has a possible overflow in calculating the memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption.

Score

CVSS 3.1 7.3 High

Status

Modified - cve@mitre.org

Published

2021-02-03

Last modified

2024-08-04

Weaknesses

CWE-190, CWE-787

Affected products

• Communications Eagle (Oracle)
• Vxworks (Windriver)

References

• https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-28895
• https://support2.windriver.com/index.php?page=defects&on=view&id=V7LIBC-1327
• https://www.oracle.com/security-alerts/cpuapr2022.html