CVE-2020-5204

CVE-2020-5204 affects uftpd prior to 2.11. A buffer overflow exists in FTP PORT parsing (ftpcmd.c handle_PORT) where a 16-byte buffer can overflow when filling input with a format string like %d.%d.%d.%d using user input. The root cause is sprintf-based population of the IPv4-like string exceedin...

CVE-2020-20277

Summary: CVE-2020-20277 affects uftpd FTP server versions 2.7–2.10. A directory traversal vulnerability arises from improper implementation of the chroot jail in common.c’s compose_abspath, allowing unauthenticated attackers to read/write arbitrary files, leak memory, and potentially cause remote...

CVE-2020-14149

Summary: CVE-2020-14149 affects uftpd prior to version 2.12. The vulnerability is a NULL pointer dereference in handle_CWD (ftpcmd.c) when processing user-supplied paths, exemplified by a CWD /.. command, leading to denial of service. Affected product/version: uftpd up to 2.11 (pre-2.12). Root ca...

CVE-2020-5221

Summary: CVE-2020-5221 affects uftpd prior to 2.11, where an unauthenticated user can perform a directory traversal using multiple FTP commands due to an inadequately implemented chroot in compose_abspath(), allowing read/write to arbitrary filesystem locations. The issue is mitigated by upgradin...

CVE-2020-20276

The CVE-2020-20276 entry describes an unauthenticated stack-based buffer overflow in uftpd FTP server versions 2.10 and earlier, specifically in common.c’s handle_PORT function. This vulnerability can cause a crash and potentially enable remote code execution. Connected sources confirm the affect...