Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Fedora 40: 2025-d37ad923f5 high: ProFTPD buffer crash fix

fedora
Calendar Grey February 22, 2025
Dist Fedora Esm H88
This patch addresses a segmentation fault vulnerability in OpenSSH on Fedora 40, which was causing client disconnections in response to specially designed inputs.
This update addresses a null pointer dereferencing issue that could cause the session for a client that sent specially-crafted commands to the server to crash (not the sessions of ...

Summary

ProFTPD is an enhanced FTP server with a focus toward simplicity, security,

and ease of configuration. It features a very Apache-like configuration

syntax, and a highly customizable server infrastructure, including support for

multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory

visibility.

This package defaults to the standalone behavior of ProFTPD, but all the

needed scripts to have it run by systemd instead are included.

Update Information:

This update addresses a null pointer dereferencing issue that could cause the session for a client that sent specially-crafted commands to the server to crash (not the sessions of other clients).

Topics%20covered

Topics Covered

security advisory high severity buffer overflow Fedora null pointer proftpd ProFTPD session crash

Change Log

* Thu Feb 13 2025 Paul Howarth - 1.3.8c-3 - Avoid NULL pointer dereferences in mod_ls (CVE-2024-57392) - https://github.com/proftpd/proftpd/issues/1866 - Add explicit BR: libxcrypt-devel * Fri Jan 17 2025 Paul Howarth - 1.3.8c-2 - Fixes for C23 compatibility - Update mod_vroot to 0.9.12 - Implement a realpath(3) callback for the FSIO API, for better interoperability of other modules when mod_vroot is in effect

References


[ 1 ] Bug #2344418 - CVE-2024-57392 proftpd: Buffer Overflow in ProFTPD [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2344418

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-d37ad923f5' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Name: proftpd
Product: Fedora 40
Version: 1.3.8c
Release: 3.fc40
URL: http://www.proftpd.org/
Summary: Flexible, stable and highly-configurable FTP server

Topics%20covered

Topics Covered

security advisory high severity buffer overflow Fedora null pointer proftpd ProFTPD session crash

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here