[ GLSA 202007-07 ] Transmission

[GLSA]

Gentoo Linux Security Advisory

Title: Transmission: Remote code execution (GLSA 202007-07)
Severity: normal
Exploitable: remote
Date: 2020-07-26
Bug(s): #723258
ID: 202007-07

Synopsis

A use-after-free possibly allowing remote execution of code was
discovered in Transmission.


Background

Transmission is a cross-platform BitTorrent client.

Affected Packages

Package: net-p2p/transmission
Vulnerable: < 3.00
Unaffected: >= 3.00
Architectures: All supported architectures


Description

Transmission mishandles some memory management which may allow
manipulation of the heap.


Impact

A remote attacker could entice a user to open a specially crafted
torrent file using Transmission, possibly resulting in execution of
arbitrary code with the privileges of the process or a Denial of Service
condition.


Workaround

There is no known workaround at this time.

Resolution

All Transmission users should upgrade to the latest version: