CVE-2020-9273 PUBLISHED

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

EPSS 68.94% · 98.6th percentile

Risk Scores

EPSS Score
68.94%
98.6th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSproftpd-dfsg0, 1.3.5-2, 1.3.5a-1
Ubuntu:18.04:LTSproftpd-dfsg0, 1.3.5d-1, 1.3.5e-1build1

Timeline

References

Open in Interactive Console →