Skip to content
Fencer Vulns
low 3.5

CVE-2020-36646 json

MediaArea ZenLib Ztring.cpp Date_From_Seconds_1970_Local unknown vulnerability

published 2023-01-07 3 y ago modified 2026-06-17 4 mo ago also EUVD-2020-24096

cvss
3.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits
0
none known

Summary

A vulnerability classified as problematic has been found in MediaArea ZenLib up to 0.4.38. This affects the function Ztring::Date_From_Seconds_1970_Local of the file Source/ZenLib/Ztring.cpp. The manipulation of the argument Value leads to unchecked return value to null pointer dereference. Upgrading to version 0.4.39 is able to address this issue. The identifier of the patch is 6475fcccd37c9cf17e0cfe263b5fe0e2e47a8408. It is recommended to upgrade the affected component. The identifier VDB-217629 was assigned to this vulnerability.

Patch / fix

  • mediaarea zenlib 0.4.39
  • libzen Debian 14, Debian 13, Debian 12 0.4.39-1

debian advisories DEBIAN-CVE-2020-36646

  • libzen Ubuntu 18.04 LTS 0.4.37-1ubuntu0.18.04.1
  • libzen Ubuntu 20.04 LTS 0.4.37-1ubuntu0.20.04.1
  • libzen Ubuntu Pro 14.04 LTS 0.4.29-1ubuntu0.1~esm1
  • libzen Ubuntu Pro 16.04 LTS 0.4.32-1ubuntu0.16.04.1+esm1

ubuntu advisories UBUNTU-CVE-2020-36646

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Exploit prediction

1.28% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CNA 3.0 3.5 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CNA 2.0 2.3 AV:A/AC:M/Au:S/C:N/I:N/A:P
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • MediaArea ZenLib

Classification

Weakness
  • CWE-690 Unchecked Return Value to NULL Pointer Dereference
  • CWE-476 NULL Pointer Dereference

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.