2023-09-18
ALT-BU-2023-5732-1
Branch sisyphus_mipsel update bulletin.
Package proftpd updated to version 1.3.8-alt0.1.ga3489a6c8 for branch sisyphus_mipsel.
Closed vulnerabilities
Published: 2020-02-18
BDU:2020-05776
Уязвимость реализации функции alloc_pool FTP-сервера ProFTPD, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.8)
Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References:
Published: 2022-11-23
BDU:2023-05663
Уязвимость FTP-сервера ProFTPD , связанная с ошибкой освобождения памяти, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
Severity: HIGH (7.5)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References:
Published: 2020-02-20
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2020-9273
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.
Severity: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References:
- openSUSE-SU-2020:0273
- openSUSE-SU-2020:0273
- [oss-security] 20210824 Possible memory leak on getspnam / getspnam_r
- [oss-security] 20210824 Possible memory leak on getspnam / getspnam_r
- [oss-security] 20210906 Re: Possible memory leak on getspnam / getspnam_r
- [oss-security] 20210906 Re: Possible memory leak on getspnam / getspnam_r
- https://cert-portal.siemens.com/productcert/pdf/ssa-679335.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-679335.pdf
- https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES
- https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES
- https://github.com/proftpd/proftpd/issues/903
- https://github.com/proftpd/proftpd/issues/903
- [debian-lts-announce] 20200221 [SECURITY] [DLA 2115-1] proftpd-dfsg security update
- [debian-lts-announce] 20200221 [SECURITY] [DLA 2115-1] proftpd-dfsg security update
- [debian-lts-announce] 20200302 [SECURITY] [DLA 2115-2] proftpd-dfsg regression update
- [debian-lts-announce] 20200302 [SECURITY] [DLA 2115-2] proftpd-dfsg regression update
- FEDORA-2020-876b1f664e
- FEDORA-2020-876b1f664e
- FEDORA-2020-76c707cff0
- FEDORA-2020-76c707cff0
- GLSA-202003-35
- GLSA-202003-35
- DSA-4635
- DSA-4635
Published: 2022-11-23
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2021-46854
mod_radius in ProFTPD before 1.3.7c allows memory disclosure to RADIUS servers because it copies blocks of 16 characters.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References:
- http://www.proftpd.org/docs/RELEASE_NOTES-1.3.7e
- http://www.proftpd.org/docs/RELEASE_NOTES-1.3.7e
- https://bugs.gentoo.org/811495
- https://bugs.gentoo.org/811495
- https://github.com/proftpd/proftpd/issues/1284
- https://github.com/proftpd/proftpd/issues/1284
- https://github.com/proftpd/proftpd/pull/1285
- https://github.com/proftpd/proftpd/pull/1285
- GLSA-202305-03
- GLSA-202305-03