CVE-2011-0418
Fixed in a distro release EPSS 7%
The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand expressions containing curly brackets, which allows remote authenticated users to cause a denial of service (memory consumption) via a crafted FTP STAT command.
Products: pureftpd pure-ftpd, netbsd
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | pure-ftpd | 1.0.32-1 |
| Debian 13 | pure-ftpd | 1.0.32-1 |
| openSUSE Tumbleweed | pure-ftpd | 1.0.43-1.3 |