Most recent entries from all

fkie_cve-2026-63090

ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.

GHSA-wxc2-grp8-f55h

OESA-2026-3231 — proftpd security update

Affected: openEuler:20.03-LTS-SP4: proftpd, openEuler:22.03-LTS-SP4: proftpd, openEuler:24.03-LTS-SP1: proftpd, openEuler:24.03-LTS-SP3: proftpd, openEuler:24.03-LTS-SP4: proftpd

ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple &apos;virtual&apos; FTP servers, anonymous FTP, and permission-based directory visibility. This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included. Security Fix(es):

ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than approximately 544 bytes), producing reliable authenticated remote denia…

UBUNTU-CVE-2026-63090

Affected: Ubuntu:16.04:LTS: proftpd-dfsg, Ubuntu:18.04:LTS: proftpd-dfsg, Ubuntu:20.04:LTS: proftpd-dfsg, Ubuntu:22.04:LTS: proftpd-dfsg, Ubuntu:24.04:LTS: proftpd-dfsg, Ubuntu:26.04:LTS: proftpd-dfsg