CVE-Katalog

CVE-2019-11366

atftp: CVE-2019-11366

[CVE-Katalog]

Schweregrad
Medium
Published
Source
[NVD] · [CVE record]
EPSS
2.10% · Oct 22, 2026

An issue was discovered in atftpd in atftp 0.7.1. It does not lock the thread_list_mutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer dereference. If thread_data is NULL when assigned to current, and modified by another thread before a certain tftpd_list.c check, there is a crash when dereferencing current->next.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianatftpsid0.8.1-2fixed
Debianatftpforky0.8.1-2fixed
Debianatftptrixie0.8.0-8fixed
Debianatftpbookworm0.8.0-3fixed
Ubuntuatftp16.040.7.git20120829-2.1vulnerable
Ubuntuatftp16.040.7.git20120829-3.1~0.16.04.1fixed
Ubuntuatftp18.040.7.git20120829-3vulnerable
Ubuntuatftp18.040.7.git20120829-3.1~0.18.04.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianatftpsourcesid0.7.git20120829-3.1not yet assignedNot reported[927553]
Debianatftpsourceforky0.7.git20120829-3.1not yet assignedNot reported[927553]
Debianatftpsourcetrixie0.7.git20120829-3.1not yet assignedNot reported[927553]
Debianatftpsourcebookworm0.7.git20120829-3.1not yet assignedNot reported[927553]
Ubuntuatftpdeb16.040.7.git20120829-3.1~0.16.04.1Not reportedUBUNTU-CVE-2019-11366Not reported
Ubuntuatftpdeb18.040.7.git20120829-3.1~0.18.04.1Not reportedUBUNTU-CVE-2019-11366Not reported

[Debian bug #927553]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [atftp]Behoben
    Details (2)

    • 0.8.0-3 · amd64 · bookworm

      Behoben · Behoben: 0.7.git20120829-3.1

      dsa · atftp · debian · bookworm; dsa · atftp · debian · 12

    • 0.8.0-3 · arm64 · bookworm

      Behoben · Behoben: 0.7.git20120829-3.1

      dsa · atftp · debian · bookworm; dsa · atftp · debian · 12

  • [atftpd]Behoben

    Quellpaket: [atftp]

    Details (2)

    • 0.8.0-3 · amd64 · bookworm

      Behoben · Behoben: 0.7.git20120829-3.1

      dsa · atftp · debian · bookworm; dsa · atftp · debian · 12

    • 0.8.0-3 · arm64 · bookworm

      Behoben · Behoben: 0.7.git20120829-3.1

      dsa · atftp · debian · bookworm; dsa · atftp · debian · 12

[Debian 13 (Trixie)]

  • [atftp]Behoben
    Details (2)

    • 0.8.0-8 · amd64 · trixie

      Behoben · Behoben: 0.7.git20120829-3.1

      dsa · atftp · debian · 13

    • 0.8.0-8 · arm64 · trixie

      Behoben · Behoben: 0.7.git20120829-3.1

      dsa · atftp · debian · 13

  • [atftpd]Behoben

    Quellpaket: [atftp]

    Details (2)

    • 0.8.0-8 · amd64 · trixie

      Behoben · Behoben: 0.7.git20120829-3.1

      dsa · atftp · debian · 13

    • 0.8.0-8 · arm64 · trixie

      Behoben · Behoben: 0.7.git20120829-3.1

      dsa · atftp · debian · 13

Beobachtet:

Referenzen

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]