Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted torrent file.

Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted torrent file.

For Debian 9 stretch, this problem has been fixed in version 2.92-2+deb9u2.

We recommend that you upgrade your transmission packages.

For the detailed security status of transmission please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/transmission

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202007-07 (Transmission: Remote code execution)

    Transmission mishandles some memory management which may allow       manipulation of the heap.
  Impact :

    A remote attacker could entice a user to open a specially crafted       torrent file using Transmission, possibly resulting in execution of       arbitrary code with the privileges of the process or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted torrent file.
(CVE-2018-10756)

Backported patch for CVE-2018-10756.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Tom Richards reported that by using a crafted torrent file one could cause a use-after-free, which might result in a denial of service (crash) or possible execution of arbitrary code.

For Debian 8 'Jessie', this problem has been fixed in version 2.84-0.2+deb8u2.

We recommend that you upgrade your transmission packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
139248	Debian DLA-2305-1 : transmission security update	Nessus	Debian Local Security Checks	high
138930	GLSA-202007-07 : Transmission: Remote code execution	Nessus	Gentoo Local Security Checks	high
138641	Amazon Linux AMI : transmission (ALAS-2020-1399)	Nessus	Amazon Linux Local Security Checks	high
137122	Fedora 32 : transmission (2020-e67318b4b4)	Nessus	Fedora Local Security Checks	high
136934	Fedora 31 : transmission (2020-3ef028d53f)	Nessus	Fedora Local Security Checks	high
136834	Debian DLA-2218-1 : transmission security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-10756

high

Tenable Plugins

high

high

high

high

high

high