CVE-2020-3946

InstallBuilder AutoUpdate tool and regular installers enabling <checkForUpdates> built with versions earlier than 19.11 are vulnerable to Billion laughs attack (denial-of-service).

Score

CVSS 3.1 7.5 High

Status

Modified - security@vmware.com

Published

2020-04-20

Last modified

2024-08-04

Weaknesses

CWE-776

Affected products

• Installbuilder (Vmware)

References

• https://blog.installbuilder.com/2019/12/configure-autoupdate-project-settings.html