New subject: [Bug 1164574] VUL-0: CVE-2020-9273: proftpd: possibility of corrupting memory pool by interrupting the data transfer channel

21 Feb 2020

      http://bugzilla.opensuse.org/show_bug.cgi?id=1164574

            Bug ID: 1164574
           Summary: VUL-1: CVE-2020-9273: proftpd: possibility of
                    corrupting memory pool by interrupting the data
                    transfer channel
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/253472/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: chris@computersalat.de
          Reporter: atoptsoglou@suse.com
        QA Contact: security-team@suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-9273

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting
the data transfer channel. This triggers a use-after-free in alloc_pool in
pool.c, and possible remote code execution.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-9273
http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-9273.html

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1164574] New: VUL-1: CVE-2020-9273: proftpd: possibility of corrupting memory pool by interrupting the data transfer channel

bugzilla_noreply＠novell.com

bugzilla_noreply＠novell.com

bugzilla_noreply＠novell.com

bugzilla_noreply＠novell.com

bugzilla_noreply＠novell.com

tags

participants (1)