A use-after-free possibly allowing remote execution of code was discovered in Transmission.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-p2p/transmission | * | < 3.00 | >= 3.00 |
Transmission is a cross-platform BitTorrent client.
Transmission mishandles some memory management which may allow manipulation of the heap.
A remote attacker could entice a user to open a specially crafted torrent file using Transmission, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All Transmission users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-p2p/transmission-3.00"
A vulnerability in Transmission could allow a remote attacker to execute arbitrary RPC commands.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-p2p/transmission | * | < 2.93 | >= 2.93 |
Transmission is a cross-platform BitTorrent client.
A vulnerability was discovered in how Transmission handles access control through the X-Transmission-Session-Id.
A remote attacker could execute arbitrary RFC commands or consequently conduct a DNS rebinding attack.
There is no known workaround at this time.
All Transmission users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-p2p/transmission-"
Stack-based buffer overflows in Transmission may allow for remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-p2p/transmission | * | < 1.92 | >= 1.92 |
Transmission is a cross-platform BitTorrent client.
Multiple stack-based buffer overflows in the tr_magnetParse() function in libtransmission/magnet.c have been discovered.
A remote attacker could cause a Denial of Service or possibly execute arbitrary code via a crafted magnet URL with a large number of tr or ws links.
There is no known workaround at this time.
All Transmission users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-p2p/transmission-1.92"