The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Respond faster and outpace attackers. Taking command of your attack surface starts here.
Respond faster and outpace attackers. Taking command of your attack surface starts here.
libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode implementation allows an out-of-bounds read because strtol is used to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for the '\0' terminator one byte too late.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade apk-tools | Aug 22, 2024 | Aug 3, 2021 |
| Freebsd | — | Upgrade FreeBSD | Nov 4, 2022 | Aug 25, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub