PatchTheCVElibtirpc vulnerabilities and fixes
Recent CVEs affecting libtirpc, with upgrade or downgrade steps. 5 tracked.
libtirpc has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2022-07-20. Highest priority: CVE-2017-8779 (score 61/100).
- CVE-2021-46828 HIGH 7.5 UPGRADE MITIGATE In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtir
- CVE-2018-14622 HIGH 7.5 UPGRADE MITIGATE A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3
- CVE-2018-14621 MEDIUM 5.3 UPGRADE An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2
- CVE-2017-8779 HIGH 7.5 UPGRADE UPGRADE rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not
- CVE-2013-1950 MEDIUM 4.3 UPGRADE The svc_dg_getargs function in libtirpc 0.2.3 and earlier allows remote attackers to cause a denial of service
FAQ
How do I fix libtirpc vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libtirpc being exploited right now?
None of the tracked libtirpc CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libtirpc CVE should I patch first?
CVE-2017-8779 currently ranks highest (61/100): rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not .