The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
An issue was discovered in atftpd in atftp 0.7.1. It does not lock the thread_list_mutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer dereference. If thread_data is NULL when assigned to current, and modified by another thread before a certain tftpd_list.c check, there is a crash when dereferencing current->next.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade atftp | May 8, 2019 | Apr 20, 2019 |
| Gentoo Linux | — | Upgrade net-ftp/atftp. | Mar 16, 2020 | Apr 20, 2019 |
| Suse | — | Upgrade atftp | Apr 30, 2019 | Apr 20, 2019 |
| Ubuntu | — | Upgrade atftpUpgrade atftpd | Sep 25, 2020 | Apr 20, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 20, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub