CVE-2021-41054

Name	CVE-2021-41054
Description	tftpd_file.c in atftp through 0.7.4 has a buffer overflow because buffer-size handling does not properly consider the combination of data, OACK, and other options.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2820-1
Debian Bugs	994895

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
atftp (PTS)	bullseye	0.7.git20120829-3.3+deb11u2	fixed
	bookworm	0.8.0-3	fixed
	forky, sid, trixie	0.8.0-8	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
atftp	source	stretch	0.7.git20120829-3.1~deb9u2	DLA-2820-1
atftp	source	buster	0.7.git20120829-3.2~deb10u2
atftp	source	bullseye	0.7.git20120829-3.3+deb11u1
atftp	source	(unstable)	0.7.git20210915-1		994895

https://sourceforge.net/p/atftp/code/ci/d255bf90834fb45be52decf9bc0b4fb46c90f205/