5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.027 Low
EPSS
Percentile
90.5%
An issue was discovered in atftpd in atftp 0.7.1. It does not lock the
thread_list_mutex mutex before assigning the current thread data structure.
As a result, the daemon is vulnerable to a denial of service attack due to
a NULL pointer dereference. If thread_data is NULL when assigned to
current, and modified by another thread before a certain tftpd_list.c
check, there is a crash when dereferencing current->next.
launchpad.net/bugs/cve/CVE-2019-11366
nvd.nist.gov/vuln/detail/CVE-2019-11366
pulsesecurity.co.nz/advisories/atftpd-multiple-vulnerabilities
security-tracker.debian.org/tracker/CVE-2019-11366
sourceforge.net/p/atftp/code/ci/382f76a90b44f81fec00e2f609a94def4a5d3580/
ubuntu.com/security/notices/USN-4540-1
ubuntu.com/security/notices/USN-4643-1
www.cve.org/CVERecord?id=CVE-2019-11366
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.027 Low
EPSS
Percentile
90.5%