CVE-2021-44847
A stack-based buffer overflow in handle_request function in DHT.c in t ...
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Ubuntu (mittel).
Beschreibung
A stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through 0.2.12 (caused by an improper length calculation during the handling of received network packets) allows remote attackers to crash the process or potentially execute arbitrary code via a network packet.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 10 | libtoxcore | kein Fix angegeben |
| debian 11 | libtoxcore | kein Fix angegeben |
| debian 12 | libtoxcore | 0.2.13-1 |
| debian 13 | libtoxcore | 0.2.13-1 |
| debian 14 | libtoxcore | 0.2.13-1 |
| echo | libtoxcore | 0.2.13-1 |
| ubuntu 20.04-ESM | libtoxcore | kein Fix angegeben |
| ubuntu 22.04 | libtoxcore | 0.2.13-1 |
| ubuntu 22.10 | libtoxcore | 0.2.13-1 |
| ubuntu 23.04 | libtoxcore | 0.2.13-1 |
| ubuntu 23.10 | libtoxcore | 0.2.13-1 |
| ubuntu 24.04 | libtoxcore | 0.2.13-1 |
Alle 17 Einträge aus 17 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 10 | libtoxcore | kein Fix angegeben |
| debian 11 | libtoxcore | kein Fix angegeben |
| debian 12 | libtoxcore | 0.2.13-1 |
| debian 13 | libtoxcore | 0.2.13-1 |
| debian 14 | libtoxcore | 0.2.13-1 |
| echo | libtoxcore | 0.2.13-1 |
| ubuntu 20.04-ESM | libtoxcore | kein Fix angegeben |
| ubuntu 22.04 | libtoxcore | 0.2.13-1 |
| ubuntu 22.10 | libtoxcore | 0.2.13-1 |
| ubuntu 23.04 | libtoxcore | 0.2.13-1 |
| ubuntu 23.10 | libtoxcore | 0.2.13-1 |
| ubuntu 24.04 | libtoxcore | 0.2.13-1 |
| ubuntu 24.10 | libtoxcore | 0.2.13-1 |
| ubuntu 25.04 | libtoxcore | 0.2.13-1 |
| ubuntu 25.10 | libtoxcore | 0.2.13-1 |
| ubuntu 26.04 | libtoxcore | 0.2.13-1 |
| ubuntu 26.10 | libtoxcore | 0.2.13-1 |
Referenzen
- https://blog.tox.chat/2021/12/stack-based-buffer-overflow-vulnerability-in-udp-packet-handling-in-toxcore-cve-2021-44847/
- https://github.com/TokTok/c-toxcore/pull/1718
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S7EBS3NIRYJ7V3PTNINP3PJSVUHGZTGA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLTKINSPO5T65LB3ZASDPCREKUE22RYE/
- https://www.cve.org/CVERecord?id=CVE-2021-44847