Debian: DSA 1222-2 Critical Proftpd Remote Threat Advisory

CVE-2006-5815

It was discovered that a buffer overflow in the sreplace() function
may lead to denial of service and possibly the execution of arbitrary
code.

CVE-2006-6170

It was discovered that a buffer overflow in the mod_tls addon module
may lead to the execution of arbitrary code.

CVE-2006-6171

It was discovered that insufficient validation of FTP command buffer
size limits may lead to denial of service. Due to unclear information
this issue was already fixed in DSA-1218 as CVE-2006-5815.

For the stable distribution (sarge) these problem has been fixed in version
1.2.10-15sarge3.

For the unstable distribution (sid) this problem has been fixed in
version 1.3.0-16 of the proftpd-dfsg package.

We recommend that you upgrade your proftpd package.


Upgrade Instructions
- --------------------wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use ...