CVE-2020-5991

unknown

Published — · Modified —

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

—

Description

NVIDIA CUDA Toolkit, all versions prior to 11.1.1, contains a vulnerability in the NVJPEG library in which an out-of-bounds read or write operation may lead to code execution, denial of service, or information disclosure.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2020-5991 NameCVE-2020-5991 DescriptionNVIDIA CUDA Toolkit, all versions prior to 11.1.1, contains a vulnerability in the NVJPEG library in which an out-of-bounds read or write operation may lead to code execution, denial of service, or information disclosure. SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub…

CVE-2020-5991

Name	CVE-2020-5991
Description	NVIDIA CUDA Toolkit, all versions prior to 11.1.1, contains a vulnerability in the NVJPEG library in which an out-of-bounds read or write operation may lead to code execution, denial of service, or information disclosure.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	973543

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nvidia-cuda-toolkit (PTS)	bullseye/non-free	11.2.2-3+deb11u3	fixed
	bookworm/non-free	11.8.0-5~deb12u1	fixed
	trixie/non-free	12.4.1-2	fixed
	sid/non-free	12.4.1-8	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
nvidia-cuda-toolkit	source	experimental	11.1.1-1
nvidia-cuda-toolkit	source	(unstable)	11.1.1-2			973543

Notes

[buster] - nvidia-cuda-toolkit <ignored> (Non-free not supported)
https://nvidia.custhelp.com/app/answers/detail/a_id/5094

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

[buster] - nvidia-cuda-toolkit <ignored> (Non-free not supported)https://nvidia.custhelp.com/app/answers/detail/a_id/5094

OS impact

OS	Version	Status	Fixed in
debian	bookworm	fixed	`11.1.1-2`
debian	bullseye	fixed	`11.1.1-2`
debian	forky	fixed	`11.1.1-2`
debian	sid	fixed	`11.1.1-2`
debian	trixie	fixed	`11.1.1-2`

References

https://security-tracker.debian.org/tracker/CVE-2020-5991

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.