File _patchinfo of Package patchinfo.11043

Overview Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo.11043

<patchinfo incident="11043">
  <issue tracker="bnc" id="1133114">VUL-0: CVE-2019-11365: atftp:  A remote attacker may send a crafted packet triggering a stack-based buffer overflow due to an insecurely implemented strncpy call. The vulnerability is trigger</issue>
  <issue tracker="bnc" id="1133145">VUL-0: CVE-2019-11366: atftp: does not lock the thread_list_mutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service at</issue>
  <issue tracker="cve" id="2019-11366"/>
  <issue tracker="cve" id="2019-11365"/>
  <packager>pmonrealgonzalez</packager>
  <rating>important</rating>
  <category>security</category>
  <summary>Security update for atftp</summary>
  <description>This update for atftp fixes the following issues:

Security issues fixed:

- CVE-2019-11366: Fixed a denial of service caused by a NULL pointer dereference because thread_list_mutex was not locked (bsc#1133145).
- CVE-2019-11365: Fixed a buffer overflow which could lead to remote code execution caused by an insecure use of strncpy() (bsc#1133114).
</description>
</patchinfo>

Places

File _patchinfo of Package patchinfo.11043

Places