[SECURITY] [DSA 4438-1] atftp security update

2019-05-0719:42:22

lists.debian.org

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

Debian Security Advisory DSA-4438-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
May 07, 2019 https://www.debian.org/security/faq

Package : atftp
CVE ID : CVE-2019-11365 CVE-2019-11366
Debian Bug : 927553

Denis Andzakovic discovered two vulnerabilities in atftp, the advanced
TFTP server which could result in denial of service by sending malformed
packets.

For the stable distribution (stretch), these problems have been fixed in
version 0.7.git20120829-3.1~deb9u1.

We recommend that you upgrade your atftp packages.

For the detailed security status of atftp please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/atftp

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian9arm64atftpd< 0.7.git20120829-3.1~deb9u1atftpd_0.7.git20120829-3.1~deb9u1_arm64.deb
Debian8i386atftpd< 0.7.git20120829-1+deb8u1atftpd_0.7.git20120829-1+deb8u1_i386.deb
Debian9mipsatftpd-dbgsym< 0.7.git20120829-3.1~deb9u1atftpd-dbgsym_0.7.git20120829-3.1~deb9u1_mips.deb
Debian8armhfatftpd< 0.7.git20120829-1+deb8u1atftpd_0.7.git20120829-1+deb8u1_armhf.deb
Debian9mipselatftpd< 0.7.git20120829-3.1~deb9u1atftpd_0.7.git20120829-3.1~deb9u1_mipsel.deb
Debian9mips64elatftpd< 0.7.git20120829-3.1~deb9u1atftpd_0.7.git20120829-3.1~deb9u1_mips64el.deb
Debian9mips64elatftp-dbgsym< 0.7.git20120829-3.1~deb9u1atftp-dbgsym_0.7.git20120829-3.1~deb9u1_mips64el.deb
Debian9mipselatftp-dbgsym< 0.7.git20120829-3.1~deb9u1atftp-dbgsym_0.7.git20120829-3.1~deb9u1_mipsel.deb
Debian9mips64elatftp< 0.7.git20120829-3.1~deb9u1atftp_0.7.git20120829-3.1~deb9u1_mips64el.deb
Debian9armelatftpd-dbgsym< 0.7.git20120829-3.1~deb9u1atftpd-dbgsym_0.7.git20120829-3.1~deb9u1_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	arm64	atftpd	< 0.7.git20120829-3.1~deb9u1	atftpd_0.7.git20120829-3.1~deb9u1_arm64.deb
Debian	8	i386	atftpd	< 0.7.git20120829-1+deb8u1	atftpd_0.7.git20120829-1+deb8u1_i386.deb
Debian	9	mips	atftpd-dbgsym	< 0.7.git20120829-3.1~deb9u1	atftpd-dbgsym_0.7.git20120829-3.1~deb9u1_mips.deb
Debian	8	armhf	atftpd	< 0.7.git20120829-1+deb8u1	atftpd_0.7.git20120829-1+deb8u1_armhf.deb
Debian	9	mipsel	atftpd	< 0.7.git20120829-3.1~deb9u1	atftpd_0.7.git20120829-3.1~deb9u1_mipsel.deb
Debian	9	mips64el	atftpd	< 0.7.git20120829-3.1~deb9u1	atftpd_0.7.git20120829-3.1~deb9u1_mips64el.deb
Debian	9	mips64el	atftp-dbgsym	< 0.7.git20120829-3.1~deb9u1	atftp-dbgsym_0.7.git20120829-3.1~deb9u1_mips64el.deb
Debian	9	mipsel	atftp-dbgsym	< 0.7.git20120829-3.1~deb9u1	atftp-dbgsym_0.7.git20120829-3.1~deb9u1_mipsel.deb
Debian	9	mips64el	atftp	< 0.7.git20120829-3.1~deb9u1	atftp_0.7.git20120829-3.1~deb9u1_mips64el.deb
Debian	9	armel	atftpd-dbgsym	< 0.7.git20120829-3.1~deb9u1	atftpd-dbgsym_0.7.git20120829-3.1~deb9u1_armel.deb