SUSE SLES11 Security Update : atftp (SUSE-SU-2019:14033-1)

This update for atftp fixes the following issues : Security issues fixed : CVE-2019-11366: Fixed a denial of service caused by a NULL pointer dereference because threadlistmutex was not locked bsc1133145. CVE-2019-11365: Fixed a buffer overflow which could lead to remote code execution caused by ...

SUSE-SU-2019:14033-1 Security update for atftp

This update for atftp fixes the following issues: Security issues fixed: - CVE-2019-11366: Fixed a denial of service caused by a NULL pointer dereference because threadlistmutex was not locked bsc1133145. - CVE-2019-11365: Fixed a buffer overflow which could lead to remote code execution caused b...

SUSE-SU-2019:1091-1 Security update for atftp

This update for atftp fixes the following issues: Security issues fixed: - CVE-2019-11366: Fixed a denial of service caused by a NULL pointer dereference because threadlistmutex was not locked bsc1133145. - CVE-2019-11365: Fixed a buffer overflow which could lead to remote code execution caused b...

UBUNTU-CVE-2019-11365

An issue was discovered in atftpd in atftp 0.7.1. A remote attacker may send a crafted packet triggering a stack-based buffer overflow due to an insecurely implemented strncpy call. The vulnerability is triggered by sending an error packet of 3 bytes or fewer. There are multiple instances of this...

CVE-2019-11366

An issue was discovered in atftpd in atftp 0.7.1. It does not lock the threadlistmutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer dereference. If threaddata is NULL when assigned to current, a...

UBUNTU-CVE-2019-11366

An issue was discovered in atftpd in atftp 0.7.1. It does not lock the threadlistmutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer dereference. If threaddata is NULL when assigned to current, a...

CVE-2019-11366

The connected sources confirm CVE-2019-11366 and CVE-2019-11365 affecting atftp/atftpd. The root cause is failure to lock the thread_list_mutex before assigning thread_data, enabling a race that can lead to a NULL pointer dereference and a crash, with potential arbitrary code execution in some co...

CVE-2019-11366

An issue was discovered in atftpd in atftp 0.7.1. It does not lock the threadlistmutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer dereference. If threaddata is NULL when assigned to current, a...

CVE-2019-11365

An issue was discovered in atftpd in atftp 0.7.1. A remote attacker may send a crafted packet triggering a stack-based buffer overflow due to an insecurely implemented strncpy call. The vulnerability is triggered by sending an error packet of 3 bytes or fewer. There are multiple instances of this...

atftp code issue vulnerability

atftp is a client implementation of the TFTP protocol. A security vulnerability exists in atftp version 0.7.1. An attacker can exploit this vulnerability to cause a denial of service...

atftp Buffer Overflow Vulnerability

atftp is a client implementation of the TFTP protocol. A buffer overflow vulnerability exists in atftp version 0.7.1. The vulnerability stems from a network system or product performing operations in memory without properly validating data boundaries, resulting in incorrect read and write...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the atftp package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

ATFTP 0.7 Timeout Command Line Argument Local Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7902/info atftp is prone to a locally exploitable buffer overflow condition. This issue is due to insufficient bounds checking performed on input supplied to the command line parameter -t for timeout. Local attackers may...

Debian Security Advisory DSA 314-1 (atftp)

The remote host is missing an update to atftp announced via advisory DSA 314-1. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2002-2396

This CVE (CVE-2002-2396) affects Advanced TFTP (atftp) versions 0.5 and 0.6. The vulnerability is a buffer overflow in code that runs when atftp is installed with setuid or setgid, allowing a local user to potentially execute arbitrary code via a long argument to the -g option. Root cause is a bu...

CVE-2003-0380

Buffer overflow in atftp daemon atftpd 0.6.1 and earlier, and possibly later versions, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long filename...

CVE-2003-0380

Buffer overflow in atftp daemon atftpd 0.6.1 and earlier, and possibly later versions, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long filename...

[SECURITY] [DSA-314-1] New atftp packages fix buffer overflow

-------------------------------------------------------------------------- Debian Security Advisory DSA 314-1 [email protected] http://www.debian.org/security/ Matt Zimmerman June 11th, 2003 http://www.debian.org/security/faq -...

CVE-2003-0380

The CVE-2003-0380 entry corresponds to a buffer overflow in the atftp daemon (atftpd) versions 0.6.1 and earlier (potentially later) that can be triggered by a long filename. This leads to remote denial of service (crash) and may allow arbitrary code execution. Public sources in the connected doc...

CVE-2003-0380

Buffer overflow in atftp daemon atftpd 0.6.1 and earlier, and possibly later versions, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long filename...