CVE-2019-11366
5.9
MEDIUM
CVSS 3.1
EPSS 1.3%
Description
An issue was discovered in atftpd in atftp 0.7.1. It does not lock the thread_list_mutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer dereference. If thread_data is NULL when assigned to current, and modified by another thread before a certain tftpd_list.c check, there is a crash when dereferencing current->next.
How to fix CVE-2019-11366
To remediate CVE-2019-11366, upgrade the affected package to a fixed version below.
- —upgrade to 0.7.git20120829-3.1 or later
Is CVE-2019-11366 being exploited?
Low — EPSS is 1.3%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 0.7.git20120829-3.1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |