ProFTPD: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• High 8.8
  CVE-2026-63090

  ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly

  ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB r…

  ProFTPD Project ProFTPD proftpd-dfsg proftpd-dfsg Debian Ubuntu
  Jul 20, 2026
• Medium 6.5
  CVE-2026-63091

  ProFTPD mod_sftp Signed Integer Overflow via SCP Size-Record Parser

  ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64_MAX, which res…

  ProFTPD Project ProFTPD proftpd-dfsg proftpd-dfsg Debian Ubuntu
  Jul 20, 2026

Revision history

1. 2026-11-10 #2

   Neue Updates von SUSE aufgenommen

2. 2026-07-20 #1

   Initiale Fassung

References

• GitHub Advisory Database vom 2026-07-20
  https://github.com/advisories/GHSA-WXC2-GRP8-F55H
• GitHub Advisory Database vom 2026-07-20
  https://github.com/advisories/GHSA-GQM5-F386-9R92
• SUSE Security Update SUSE-SU-2026:5181-1 vom 2026-11-11
  https://lists.suse.com/pipermail/sle-security-updates/2026-November/030549.html