CVE-2020-36619— multimon-ng demod_flex.c add_ch format string
Quick assessment
Affected
unspecified multimon-ng
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
multimon-ng是Elias Önal个人开发者的一个库。可以解码 VHF/UHF 无线电上常见的各种数字传输模式。 multimon-ng存在格式化字符串错误漏洞，该漏洞源于文件demod_flex.c的函数add_ch存在问题，对参数ch的操作会导致格式化字符串。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-36619
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
multimon-ng demod_flex.c add_ch format string
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was found in multimon-ng. It has been rated as critical. This issue affects the function add_ch of the file demod_flex.c. The manipulation of the argument ch leads to format string. Upgrading to version 1.2.0 is able to address this issue. The name of the patch is e5a51c508ef952e81a6da25b43034dd1ed023c07. It is recommended to upgrade the affected component. The identifier VDB-216269 was assigned to this vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
内存缓冲区边界内操作的限制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
multimon-ng 格式化字符串错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
multimon-ng是Elias Önal个人开发者的一个库。可以解码 VHF/UHF 无线电上常见的各种数字传输模式。 multimon-ng存在格式化字符串错误漏洞，该漏洞源于文件demod_flex.c的函数add_ch存在问题，对参数ch的操作会导致格式化字符串。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| unspecified | multimon-ng | n/a | - |
|
II. Public POCs for CVE-2020-36619
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-36619
请登录查看更多情报信息。
Patches & Fixes for CVE-2020-36619 (2)
Vendor Advisories for CVE-2020-36619 (1)
Other References for CVE-2020-36619 (1)
Same Patch Batch · unspecified · 2022-12-19 · 5 CVEs total
| CVE-2021-4260 | 6.3 MEDIUM | oils-js Web.js redirect |
| CVE-2021-4261 | 6.3 MEDIUM | pacman-canvas db-handler.php addHighscore sql injection |
| CVE-2021-4262 | 5.5 MEDIUM | laravel-jqgrid EloquentRepositoryAbstract.php getRows sql injection |
| CVE-2021-4258 | 3.7 LOW | whohas Package Information cleartext transmission |
IV. Related Vulnerabilities
Same vendor: unspecified