8.4high
CVE-2016-20040
TiEmu 3.03-nogdb+dfsg-3 Buffer Overflow via ROM Parameter
Published 7 mo ago · modified 4 mo ago · JSON
CVSS
8.4
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.2%
percentile 6%
Public exploits
0
none known
Summary
TiEmu 3.03-nogdb+dfsg-3 contains a buffer overflow vulnerability in the ROM parameter handling that allows local attackers to crash the application or execute arbitrary code. Attackers can supply an oversized ROM parameter to the tiemu command-line interface to overflow the stack buffer and overwrite the instruction pointer with malicious addresses.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction (EPSS)
0.17% probability of exploitation in the next 30 days, higher than 6% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- ticalc Texas Instrument Emulator
Classification
- Weakness
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
- exploit-db.com /exploits/39692 · exploit
- lpg.ticalc.org /prj_tiemu/ · product
- vulncheck.com /advisories/tiemu-nogdb-dfsg-3-buffer-overflow-via-rom-parameter · third-party-advisory
Sources
- CVE List: CVE-2016-20040
- NVD: CVE-2016-20040
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.