CVE-2020-27350

apt integer wraparound

MEDIUM

5.7

CVSS Score

Published: December 10, 2020 at 04:05 AM UTC

Updated: June 17, 2026 at 03:09 AM UTC

6 products affected across 3 vendorsSolidfire Baseboard Management Controller FirmwareAdvanced Package ToolDebian Linux

Using apt by Canonical?

Get instant alerts when new vulnerabilities affect apt - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.7

Exploit prediction

EPSS 0.4%

Description

APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Advanced Package Tool · Debian

95%

v < 1.8.2.21.2.32ubuntu0 ≤ v < 1.2.32ubuntu0.21.6.12ubuntu0 ≤ v < 1.6.12ubuntu0.22.0.2ubuntu0 ≤ v < 2.0.2ubuntu0.22.1.10ubuntu0 ≤ v < 2.1.10ubuntu0.2

Affected range stops below 1.2.32ubuntu0.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.6.12ubuntu0.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.8.2.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.0.2ubuntu0.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.1.10ubuntu0.2, so it looks safe — our inference, not a vendor statement

canonical-ubuntu-linux (environment) · debian-debian-linux (environment)

Solidfire Baseboard Management Controller Firmware · NetApp

95%

All versions

netapp-solidfire-baseboard-management-controller (same device)

Advanced Package Tool (APT)· Canonical

60%

1.2.32ubuntu0 ≤ v < 1.2.32ubuntu0.21.6.12ubuntu0 ≤ v < 1.6.12ubuntu0.22.0.2ubuntu0 ≤ v < 2.0.2ubuntu0.22.1.10ubuntu0 ≤ v < 2.1.10ubuntu0.11.2.32ubuntu0 1.6.12ubuntu0 2.0.2ubuntu0 2.1.10ubuntu0

Affected range stops below 1.2.32ubuntu0.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.6.12ubuntu0.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.0.2ubuntu0.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.1.10ubuntu0.1, so it looks safe — our inference, not a vendor statement

Ubuntu Linux · Canonicalrubygemsdevice

80%

All versions

Debian Linux · Debiandrupaldevice

80%

All versions

Solidfire Baseboard Management Controller · NetAppdevice

80%