CVE-2020-9273
Fixed in a distro release EPSS 12%
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.
Products: proftpd, debian_linux, fedoraproject fedora, opensuse backports_sle, opensuse leap, siemens simatic_net_cp_1545-1_firmware, siemens simatic_net_cp_1543-1_firmware
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | proftpd-dfsg | 1.3.6-4+deb10u4 |
| Debian 12 | proftpd-dfsg | 1.3.6c-2 |
| Debian 13 | proftpd-dfsg | 1.3.6c-2 |
| Debian 14 | proftpd-dfsg | 1.3.6c-2 |
| Debian 8 | proftpd-dfsg | 1.3.5e+r1.3.5-2+deb8u6 |
| Debian 8 | proftpd-dfsg | 1.3.5e+r1.3.5-2+deb8u7 |
| Debian 9 | proftpd-dfsg | 1.3.5b-4+deb9u4 |
| SUSE Package Hub 15 | proftpd | 1.3.6c-bp151.4.9.1 |
| SUSE Package Hub 15 SP1 | proftpd | 1.3.6c-bp151.4.9.1 |
| Ubuntu 16.04 LTS | proftpd-dfsg | no fix |
| Ubuntu 18.04 LTS | proftpd-dfsg | no fix |
| openSUSE Leap 15.1 | proftpd | 1.3.6c-bp151.4.9.1 |
| openSUSE Tumbleweed | proftpd | 1.3.6e-1.10 |