| Package | Affected versions | Patched versions |
|---|---|---|
| pure-ftpd | = 0.90= 0.91= 0.92= 0.93= 0.94= 0.95= 0.95-pre1= 0.95-pre2= 0.95-pre3= 0.95-pre4= 0.95.1= 0.95.2= 0.96= 0.96.1= 0.96pre1= 0.97-final= 0.97.1= 0.97.2= 0.97.3= 0.97.4= 0.97.5= 0.97.6= 0.97.7= 0.97.7pre1= 0.97.7pre2= 0.97.7pre3= 0.97pre1= 0.97pre2= 0.97pre3= 0.97pre4= 0.97pre5= 0.98-final= 0.98.1= 0.98.2= 0.98.2a= 0.98.3= 0.98.4= 0.98.5= 0.98.6= 0.98.7= 0.98pre1= 0.98pre2= 0.99= 0.99.1= 0.99.1a= 0.99.1b= 0.99.2= 0.99.2a= 0.99.3= 0.99.4= 0.99.9= 0.99a= 0.99b= 0.99pre1= 0.99pre2= 1.0.0= 1.0.1= 1.0.10= 1.0.11= 1.0.12= 1.0.13a= 1.0.14= 1.0.15= 1.0.16a= 1.0.16b= 1.0.16c= 1.0.17= 1.0.17a= 1.0.18= 1.0.19= 1.0.2= 1.0.20= 1.0.21= 1.0.22= 1.0.24= 1.0.25= 1.0.26= 1.0.27= 1.0.28= 1.0.29= 1.0.3= 1.0.30= 1.0.4= 1.0.5= 1.0.6= 1.0.7= 1.0.8= 1.0.9≤ 1.0.31 |
The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand expressions containing curly brackets, which allows remote authenticated users to cause a denial of service (memory consumption) via a crafted FTP STAT command.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free