CVE-2021-36159
Critical
Description
libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode implementation allows an out-of-bounds read because strtol is used to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for the '\0' terminator one byte too late.
SeverityCritical
CVSS9.1
Exploit probability—
Product
Freebsd Libfetch
PublishedAug 3, 2021
First seenAug 3, 2021
How to fix
Update
- freebsd libfetch2021-07-26 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| freebsd libfetch | v < 2021-07-26 | 2021-07-26 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.