Description
ProFTPD 1.3.7 has an out-of-bounds (OOB) read vulnerability in mod_cap via the cap_text.c cap_to_text function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | proftpd-dfsg | 1.3.6c-1 | — |
| Debian 13 | proftpd-dfsg | 1.3.6c-1 | — |
| Debian 12 | proftpd-dfsg | 1.3.6c-1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP1 | proftpd | 1.3.6c-bp151.4.9.1 | openSUSE-SU-2020:0273-1 |
| SUSE Package Hub 15 | proftpd | 1.3.6c-bp151.4.9.1 | openSUSE-SU-2020:0273-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | proftpd | 1.3.6e-1.10 | openSUSE-SU-2024:11196-1 |
| openSUSE Leap 15.1 | proftpd | 1.3.6c-bp151.4.9.1 | openSUSE-SU-2020:0273-1 |
Advisories 4
- openSUSE-SU-2020:0273-1 Security update for proftpd SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11196-1 proftpd-1.3.6e-1.10 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ICSA-21-222-07 Siemens SIMATIC CP (Update A) CISA ICS & IT advisories · Jun 14, 2022
- SSA-679335 SSA-679335: Multiple Vulnerabilities in Embedded FTP Server of SIMATIC CP Modules Siemens ProductCERT · Jun 14, 2022