CVE-2020-15107

In openenclave before 0.10.0, enclaves that use x87 FPU operations are vulnerable to tampering by a malicious host application. By violating the Linux System V Application Binary Interface (ABI) for such operations, a host app can compromise the execution integrity of some x87 FPU operations in an enclave. Depending on the FPU control configuration of the enclave app and whether the operations are used in secret-dependent execution paths, this vulnerability may also be used to mount a side-channel attack on the enclave. This has been fixed in 0.10.0 and the current master branch. Users will need to recompile their applications against the patched libraries to be protected from this vulnerability.

• https://github.com/openenclave/openenclave/security/advisories/GHSA-7wjx-wcwg-w999Third Party Advisory
• https://github.com/openenclave/openenclave/security/advisories/GHSA-7wjx-wcwg-w999Third Party Advisory

Published

Jul 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15101In freewvs before 0.1.1, a directory structure of more than …3.3
• CVE-2020-15102In PrestaShop Dashboard Productions before version 2.1.0, th…6.5
• CVE-2020-15103In FreeRDP less than or equal to 2.1.2, an integer overflow …3.5
• CVE-2020-15104In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 …5.4
• CVE-2020-15105Django Two-Factor Authentication before 1.12, stores the use…5.4
• CVE-2020-15106In etcd before versions 3.3.23 and 3.4.10, a large slice cau…6.5
• CVE-2020-15108In glpi before 9.5.1, there is a SQL injection for all usage…7.1
• CVE-2020-15109In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there i…5.3
• CVE-2020-1511An elevation of privilege vulnerability exists when Connecte…7.8
• CVE-2020-15110In jupyterhub-kubespawner before 0.12, certain usernames wil…8.1
• CVE-2020-15111In Fiber before version 1.12.6, the filename that is given i…5.4
• CVE-2020-15112In etcd before versions 3.3.23 and 3.4.10, it is possible to…6.5