Description
In uftpd before 2.12, handle_CWD in ftpcmd.c mishandled the path provided by the user, causing a NULL pointer dereference and denial of service, as demonstrated by a CWD /.. command.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | uftpd | 2.12-lp151.2.6.1 | openSUSE-SU-2020:0865-1 |
Advisories 1
- openSUSE-SU-2020:0865-1 Security update for uftpd SUSE / openSUSE Security Updates · May 7, 2025