CVE-2007-2010: Improper Restriction of Operations within the Bounds of a Memory Buffer

Double free vulnerability in bftpd before 1.8 allows remote authenticated users to cause a denial of service daemon crash via a 1 get or 2 mget command...

tnftp -- mget does not check for directory escapes

When downloading a batch of files from an FTP server the mget command does not check for directory escapes. A specially crafted file on the FTP server could then potentially overwrite an existing file of the user...