Description
An issue was discovered in Bftpd 5.3. Under certain circumstances, an out-of-bounds read is triggered due to an uninitialized value. The daemon crashes at startup in the hidegroups_init function in dirlist.c.
References (2)
Core 2
Core References
Release Notes, Vendor Advisory x_refsource_confirm
http://bftpd.sourceforge.net/news.html
Release Notes, Third Party Advisory x_refsource_confirm
https://fossies.org/linux/bftpd/CHANGELOG
Scores
CVSS v3
9.1
EPSS
0.0057
EPSS Percentile
68.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Details
CWE
CWE-125
Status
published
Products (1)
bftpd_project/bftpd
5.3
Published
Jan 10, 2020
Tracked Since
Feb 18, 2026