CVE catalog
CVE-2020-36619
multimon-ng: CVE-2020-36619
- Severity
- Critical · CVSS 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.97% · Oct 25, 2026
A vulnerability was found in multimon-ng. It has been rated as critical. This issue affects the function add_ch of the file demod_flex.c. The manipulation of the argument ch leads to format string. Upgrading to version 1.2.0 is able to address this issue. The name of the patch is e5a51c508ef952e81a6da25b43034dd1ed023c07. It is recommended to upgrade the affected component. The identifier VDB-216269 was assigned to this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | multimon-ng | sid | 1.3.1+dfsg-1.1 | fixed |
| Debian | multimon-ng | forky | 1.3.1+dfsg-1.1 | fixed |
| Debian | multimon-ng | trixie | 1.3.1+dfsg-1 | fixed |
| Debian | multimon-ng | bookworm | 1.2.0+dfsg-1 | fixed |
| Suse | multimon-ng | package hub 15 sp4 | 1.2.0-bp154.2.3.1 | fixed |
| Opensuse | multimon-ng | leap 15.4 | 1.2.0-bp154.2.3.1 | fixed |
| Suse | multimon-ng | package hub 15 sp3 | 1.2.0-bp153.2.3.1 | fixed |
| Opensuse | multimon-ng | leap 15.3 | 1.2.0-bp153.2.3.1 | fixed |
| Ubuntu | multimon-ng | 20.04 | 1.1.8+dfsg-1build1 | vulnerable |
| Ubuntu | multimon-ng | 22.04 | 1.1.9+dfsg-1 | vulnerable |
| Ubuntu | multimon-ng | 22.04 | 1.1.9+dfsg-2 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | multimon-ng | source | sid | 1.2.0+dfsg-1 | not yet assigned | Not reported | Not reported |
| Debian | multimon-ng | source | forky | 1.2.0+dfsg-1 | not yet assigned | Not reported | Not reported |
| Debian | multimon-ng | source | trixie | 1.2.0+dfsg-1 | not yet assigned | Not reported | Not reported |
| Debian | multimon-ng | source | bookworm | 1.2.0+dfsg-1 | not yet assigned | Not reported | Not reported |
| Suse | multimon-ng | rpm | package hub 15 sp4 | 1.2.0-bp154.2.3.1 | Not reported | OPENSUSE-SU-2022:10253-1 | Not reported |
| Opensuse | multimon-ng | rpm | leap 15.4 | 1.2.0-bp154.2.3.1 | Not reported | OPENSUSE-SU-2022:10253-1 | Not reported |
| Suse | multimon-ng | rpm | package hub 15 sp3 | 1.2.0-bp153.2.3.1 | Not reported | OPENSUSE-SU-2023:0004-1 | Not reported |
| Opensuse | multimon-ng | rpm | leap 15.3 | 1.2.0-bp153.2.3.1 | Not reported | OPENSUSE-SU-2023:0004-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [multimon-ng]Fixed
Details (2)
1.2.0+dfsg-1· amd64 · bookwormFixed · Fixed:
1.2.0+dfsg-1dsa · multimon-ng · debian · bookworm; dsa · multimon-ng · debian · 12
1.2.0+dfsg-1· arm64 · bookwormFixed · Fixed:
1.2.0+dfsg-1dsa · multimon-ng · debian · bookworm; dsa · multimon-ng · debian · 12
[Debian 13 (Trixie)]
- [multimon-ng]Fixed
Source package: [multimon-ng]
Details (2)
1.3.1+dfsg-1· amd64 · trixieFixed · Fixed:
1.2.0+dfsg-1dsa · multimon-ng · debian · 13
1.3.1+dfsg-1+b1· arm64 · trixieFixed · Fixed:
1.2.0+dfsg-1dsa · multimon-ng · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2022_10253-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2020-36619]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2020-36619]
- [https://osv.dev/vulnerability/openSUSE-SU-2022:10253-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2023:0004-1]
- [https://security-tracker.debian.org/tracker/CVE-2020-36619]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]