Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia 7 MGASA-2020-0128 Moderate: Fixes For Pure-FTPd Security Issues

mageia
Calendar Grey March 6, 2020
Dist Mageia Esm H88
Recent updates to the pure-ftpd packages address several security vulnerabilities identified in Mageia. Key information is provided.
Updated pure-ftpd packages fix security vulnerabilities: An issue was discovered in Pure-FTPd 1.0.49

Summary

Updated pure-ftpd packages fix security vulnerabilities:
An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_alias(const char alias) or print_aliases(void) function is called, they fail to correctly detect the end of the linked list and try to access a non-existent list member. This is related to init_aliases in diraliases.c. (CVE-2019-9274).
An issue was discovered in Pure-FTPd 1.0.49. An out-of-bounds (OOB) read has been detected in the pure_strcmp function in utils.c (CVE-2019-9365).
In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c (CVE-2019-20176).

References

- https://bugs.mageia.org/show_bug.cgi?id=26229

- https://www.cve.org/CVERecord?id=CVE-2019-9274

- https://www.cve.org/CVERecord?id=CVE-2019-9365

- https://www.cve.org/CVERecord?id=CVE-2019-20176

Topics%20covered

Topics Covered

security advisory out-of-bounds read uninitialized pointer stack exhaustion pure-ftpd Mageia

Resolution

SRPMS

- 7/core/pure-ftpd-1.0.47-7.mga7

Severity
important
Lowest
Low
Medium
High
Critical

Publication date: 06 Mar 2020
URL: https://advisories.mageia.org/MGASA-2020-0128.html
Type: security
CVE: CVE-2019-9274, CVE-2019-9365, CVE-2019-20176

Topics%20covered

Topics Covered

security advisory out-of-bounds read uninitialized pointer stack exhaustion pure-ftpd Mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here