CVE-2021-44847

CRITICAL9.8

A stack-based buffer overflow in handle_request function in DHT

Published Dec 13, 2021

Modified 1 years ago

Details

A stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through 0.2.12 (caused by an improper length calculation during the handling of received network packets) allows remote attackers to crash the process or potentially execute arbitrary code via a network packet.

References

WEB

https://github.com/TokTok/c-toxcore/pull/1718

ADVISORY

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7EBS3NIRYJ7V3PTNINP3PJSVUHGZTGA/

ADVISORY

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLTKINSPO5T65LB3ZASDPCREKUE22RYE/

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2021-44847

CVSS Analysis

CVSS v3.1

9.8