Medium ELSA-2026-0606 1 CVE

Moderate: vsftpd security update (Oracle Linux 10)

Published Jan 15, 2026 · Updated Jan 15, 2026

Ecosystem: Oracle Linux

Summary

[3.0.5-10.1]
- Fix CVE-2025-14242
- Resolves: RHEL-134158

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 10	vsftpd	0:3.0.5-10.el10_1.1

Vulnerabilities 1

Medium 6.5

CVE-2025-14242

Vsftpd: vsftpd: denial of service via integer overflow in ls command parameter parsing

A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing, triggered by a remote, authenticated attacker sending a crafted STAT command with a specific byte sequence.

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux

Jan 14, 2026