CVE-2020-35357

A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.

• CWE-120

• https://git.savannah.gnu.org/cgit/gsl.git/commit/?id=989a193268b963aa1047814f7f1402084fb7d859Mailing List, Patch
• https://lists.debian.org/debian-lts-announce/2023/09/msg00023.htmlMailing List, Third Party Advisory
• https://savannah.gnu.org/bugs/?59624Patch
• https://git.savannah.gnu.org/cgit/gsl.git/commit/?id=989a193268b963aa1047814f7f1402084fb7d859Mailing List, Patch
• https://lists.debian.org/debian-lts-announce/2023/09/msg00023.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2024/12/msg00006.html
• https://savannah.gnu.org/bugs/?59624Patch

Published

Aug 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35340A local file inclusion vulnerability in ExpertPDF 9.5.0 thro…7.5
• CVE-2020-35342GNU Binutils before 2.34 has an uninitialized-heap vulnerabi…7.5
• CVE-2020-35346CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability …4.8
• CVE-2020-35347CXUUCMS V3 3.1 has a CSRF vulnerability that can add an admi…6.5
• CVE-2020-35349Savsoft Quiz 5 is affected by: Cross Site Scripting (XSS) vi…4.8
• CVE-2020-3535A vulnerability in the loading mechanism of specific DLLs in…8.4
• CVE-2020-35358DomainMOD domainmod-v4.15.0 is affected by an insufficient s…9.8
• CVE-2020-35359Pure-FTPd 1.0.48 allows remote attackers to prevent legitima…7.5
• CVE-2020-3536A vulnerability in the web-based management interface of Cis…5.4
• CVE-2020-35362DEXT5Upload 2.7.1262310 and earlier is affected by Directory…7.5
• CVE-2020-35364Beijing Huorong Internet Security 5.0.55.2 allows a non-admi…9.8
• CVE-2020-3537A vulnerability in Cisco Jabber for Windows software could a…5.7