{"action":"Upgrade bsdiff4 to 1.2.0 or later.","affected":[{"fixed":"1.2.0","introduced":"0"}],"component":"bsdiff4","cve_ids":["CVE-2020-15904"],"ecosystem":"PyPI","epss":0.0105,"exploited":false,"fixed_versions":["1.2.0"],"ghsa_id":"GHSA-f8m3-jpxr-hm5x","id":"tcs_01M5KGABDG0K09Y0E9JBPV6KZN","modified_at":"2026-06-10T17:00:39.031299899Z","published_at":"2020-07-22T23:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-30","https://github.com/ilanschnell/bsdiff4/commit/49a4cee2feef7deaf9d89e5e793a8824930284d7","https://github.com/ilanschnell/bsdiff4/blob/master/CHANGELOG.txt","https://github.com/advisories/GHSA-f8m3-jpxr-hm5x"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"PYSEC-2020-30","url":"https://osv.dev/vulnerability/PYSEC-2020-30"},{"source":"nvd","source_id":"CVE-2020-15904","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15904"}],"summary":"A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a crafted patch file."}