CVE-2020-35357

MEDIUM 6.5CVE-2020-35357 · Published 22/08/2023 · updated 17/06/2026

In short

CVE-2020-35357 is a MEDIUM (CVSS 6.5) vulnerability affecting gnu scientific library (gnu).
Chance of exploitation in the next 30 days (EPSS): 0.97%, higher than 61.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
gnu scientific library gnu	`= 2.5= 2.6`	No fix yet

Description

A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.

References

git.savannah.gnu.org/cgit/gsl.git/commit · Mailing List
lists.debian.org/debian-lts-announce/2023/09/msg00023.html · Mailing List
savannah.gnu.org/bugs · Patch
lists.debian.org/debian-lts-announce/2024/12/msg00006.html

More vulnerabilities in gnu scientific library

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free