CVE-2020-15158

In libIEC61850 before version 1.4.3, when a message with COTP message length field with value < 4 is received an integer underflow will happen leading to heap buffer overflow. This can cause an application crash or on some platforms even the execution of remote code. If your application is used in open networks or there are untrusted nodes in the network it is highly recommend to apply the patch. This was patched with commit 033ab5b. Users of version 1.4.x should upgrade to version 1.4.3 when available. As a workaround changes of commit 033ab5b can be applied to older versions.

• CWE-119
• CWE-122
• CWE-191

• https://github.com/mz-automation/libiec61850/commit/033ab5b6488250c8c3b838f25a7cbc3e099230bbPatch, Third Party Advisory
• https://github.com/mz-automation/libiec61850/issues/250Third Party Advisory
• https://github.com/mz-automation/libiec61850/security/advisories/GHSA-pq77-fmf7-hjw8Third Party Advisory
• https://github.com/mz-automation/libiec61850/commit/033ab5b6488250c8c3b838f25a7cbc3e099230bbPatch, Third Party Advisory
• https://github.com/mz-automation/libiec61850/issues/250Third Party Advisory
• https://github.com/mz-automation/libiec61850/security/advisories/GHSA-pq77-fmf7-hjw8Third Party Advisory

Published

Aug 26, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15152ftp-srv is an npm package which is a modern and extensible F…9.1
• CVE-2020-15153Ampache before version 4.2.2 allows unauthenticated users to…9.8
• CVE-2020-15154baserCMS 4.3.6 and earlier is affected by Cross Site Scripti…7.3
• CVE-2020-15155baserCMS 4.3.6 and earlier is affected by Cross Site Scripti…7.3
• CVE-2020-15156In nodebb-plugin-blog-comments before version 0.7.0, a logge…8.1
• CVE-2020-15157In containerd (an industry-standard container runtime) befor…6.1
• CVE-2020-15159baserCMS 4.3.6 and earlier is affected by Cross Site Scripti…7.6
• CVE-2020-1516An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15160PrestaShop from version 1.7.5.0 and before version 1.7.6.8 i…9.8
• CVE-2020-15161In PrestaShop from version 1.6.0.4 and before version 1.7.6.…6.1
• CVE-2020-15162In PrestaShop from version 1.5.0.0 and before version 1.7.6.…5.4
• CVE-2020-15163Python TUF (The Update Framework) reference implementation b…8.2