Unscored severity · published May 7, 2010
CVE-2010-1853
Multiple stack-based buffer overflows in the tr_magnetParse function in libtransmission/magnet.c in Transmission 1.91 allow remote attackers to cause a denial of service (crash)…
–
CVSS
3.8%
EPSS
No
On KEV
Description
Multiple stack-based buffer overflows in the tr_magnetParse function in libtransmission/magnet.c in Transmission 1.91 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted magnet URL with a large number of (1) tr or (2) ws links.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.8% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
Transmission · Transmissionbt
1.91 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-1853
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-1853
Vendor Advisory
http://secunia.com/advisories/39031
trac.transmissionbt.com
http://trac.transmissionbt.com/changeset/10279
trac.transmissionbt.com
http://trac.transmissionbt.com/ticket/2965
trac.transmissionbt.com
http://trac.transmissionbt.com/wiki/Changes
www.osvdb.org
http://www.osvdb.org/63066
Patch
http://www.securityfocus.com/bid/38814
More from Transmission
9.8
CVE-2010-0748
Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified impact via a large number of tr arguments in a magnet link
8.8
CVE-2018-5702
Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary…
8.8
CVE-2010-0012
Directory traversal vulnerability in libtransmission/metainfo.c in Transmission 1.22, 1.34, 1.75, and 1.76 allows remote attackers to overwrite arbitrary files via a
7.8
CVE-2018-10756
Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a…
5.3
CVE-2010-0749
Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame