CVE-2020-20277

There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server versions 2.7 to 2.10 due to improper implementation of a chroot jail in common.c's composeabspath function that can be abused to read or write to arbitrary files on the filesystem,...

uftpd Buffer Error Vulnerability

uftpd is a Linux-based FTP/TFTP file transfer server from the Swedish individual developer Joachim Nilsson. A buffer error vulnerability exists in uftpd FTP server versions 2.10 and earlier, which stems from a common unauthenticated stack-based buffer overflow vulnerability, ccommon.c's handlePOR...

PT-2020-15252 · Uftpd · Uftpd

Name of the Vulnerable Software and Affected Versions: uftpd FTP server versions 2.7 to 2.10 Description: The issue arises from improper implementation of a chroot jail in the compose abspath function in common.c, leading to multiple unauthenticated directory traversal vulnerabilities in differen...

uftpd Path Traversal Vulnerability

uftpd is a Linux-based FTP/TFTP file transfer server from the Swedish individual developer Joachim Nilsson. A path traversal vulnerability exists in uftpd FTP server versions 2.7 to 2.10, which stems from multiple unauthenticated directory traversal vulnerabilities in different FTP commands, due ...

openSUSE Security Update : uftpd (openSUSE-2020-865)

This update for uftpd fixes the following issues : uftpd was updated to version 2.12. Changes : - Use common log message format and log level when user enters an invalid path. This unfortunately affects changes introduced in v2.11 to increase logging at default log level. Security fixes : -...

openSUSE: Security Advisory for uftpd (openSUSE-SU-2020:0865-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2020:0865-1 Security update for uftpd

This update for uftpd fixes the following issues: uftpd was updated to version 2.12. Changes: Use common log message format and log level when user enters an invalid path. This unfortunately affects changes introduced in v2.11 to increase logging at default log level. Security fixes: -...

Security update for uftpd (moderate)

openSUSE Security Update: Security update for uftpd Announcement ID: openSUSE-SU-2020:0865-1 Rating: moderate References: 1172959 Cross-References: CVE-2020-14149 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for uftpd fixe...

uftpd Null Pointer Dereference Vulnerability

uftpd is a Linux FTP/TFTP server. A null pointer dereference vulnerability exists in uftpd versions prior to 2.12. The vulnerability stems from the failure of handleCWD in ftpcmd.c in uftpd to properly handle user-supplied paths. An attacker can cause a denial of service via the CWD /... command ...

CVE-2020-14149

In uftpd before 2.12, handleCWD in ftpcmd.c mishandled the path provided by the user, causing a NULL pointer dereference and denial of service, as demonstrated by a CWD /.. command...

CVE-2020-14149

In uftpd before 2.12, handleCWD in ftpcmd.c mishandled the path provided by the user, causing a NULL pointer dereference and denial of service, as demonstrated by a CWD /.. command...

Null pointer dereference

In uftpd before 2.12, handleCWD in ftpcmd.c mishandled the path provided by the user, causing a NULL pointer dereference and denial of service, as demonstrated by a CWD /.. command...

CVE-2020-14149

Summary: CVE-2020-14149 affects uftpd prior to version 2.12. The vulnerability is a NULL pointer dereference in handle_CWD (ftpcmd.c) when processing user-supplied paths, exemplified by a CWD /.. command, leading to denial of service. Affected product/version: uftpd up to 2.11 (pre-2.12). Root ca...

CVE-2020-14149

In uftpd before 2.12, handleCWD in ftpcmd.c mishandled the path provided by the user, causing a NULL pointer dereference and denial of service, as demonstrated by a CWD /.. command...

uftpd Path Traversal Vulnerability

uftpd is a Linux-based FTP/TFTP file transfer server. A path traversal vulnerability exists in uftpd versions prior to 2.11. An attacker can exploit this vulnerability to read or write to any location on the file system with the help of several different FTP commands...

openSUSE: Security Advisory for uftpd (openSUSE-SU-2020:0069_1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2020-5221

In uftpd before 2.11, it is possible for an unauthenticated user to perform a directory traversal attack using multiple different FTP commands and read and write to arbitrary locations on the filesystem due to the lack of a well-written chroot jail in composeabspath. This has been fixed in versio...

CVE-2020-5221

In uftpd before 2.11, it is possible for an unauthenticated user to perform a directory traversal attack using multiple different FTP commands and read and write to arbitrary locations on the filesystem due to the lack of a well-written chroot jail in composeabspath. This has been fixed in versio...

Directory traversal

In uftpd before 2.11, it is possible for an unauthenticated user to perform a directory traversal attack using multiple different FTP commands and read and write to arbitrary locations on the filesystem due to the lack of a well-written chroot jail in composeabspath. This has been fixed in versio...

CVE-2020-5221 Directory Traversal (Chroot Escape) vulnerability in uftpd

In uftpd before 2.11, it is possible for an unauthenticated user to perform a directory traversal attack using multiple different FTP commands and read and write to arbitrary locations on the filesystem due to the lack of a well-written chroot jail in composeabspath. This has been fixed in versio...