Medium ELSA-2026-0608 1 CVE

Moderate: vsftpd security update (Oracle Linux 8)

Published Jan 15, 2026 · Updated Jan 15, 2026

Ecosystem: Oracle Linux

Summary

[3.0.3-36.3]
- Rebuild to test with proper configuration
- Related: RHEL-134160

[3.0.3-36.2]
- Rebuild to test with proper configuration
- Related: RHEL-134160

[3.0.3-36.1]
- Fix CVE-2025-14242
- Resolves: RHEL-134160

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 8	vsftpd	0:3.0.3-36.el8_10.3

Vulnerabilities 1

Medium 6.5

CVE-2025-14242

Vsftpd: vsftpd: denial of service via integer overflow in ls command parameter parsing

A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing, triggered by a remote, authenticated attacker sending a crafted STAT command with a specific byte sequence.

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux

Jan 14, 2026