Nixpkgs Security Tracker

Login with GitHub

Suggestions search

All statuses

Filter by:

With package: vsftpd

Found 2 matching suggestions

View:

Compact

Detailed

Untriaged

Permalink CVE-2011-2523

created 1 month ago

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor …

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

References

https://security-tracker.debian.org/tracker/CVE-2011-2523 x_refsource_MISC
https://access.redhat.com/security/cve/cve-2011-2523 x_refsource_MISC
[oss-security] 20110711 Re: vsftpd download backdoored x_refsource_MLIST mailing-list
https://vigilance.fr/vulnerability/vsftpd-backdoor-in-version-2-3-4-10805 x_refsource_MISC
https://packetstormsecurity.com/files/102745/VSFTPD-2.3.4-Backdoor-Command-Exec… x_refsource_MISC
http://packetstormsecurity.com/files/162145/vsftpd-2.3.4-Backdoor-Command-Execu… x_refsource_MISC
https://security-tracker.debian.org/tracker/CVE-2011-2523 x_transferred x_refsource_MISC
https://access.redhat.com/security/cve/cve-2011-2523 x_transferred x_refsource_MISC
[oss-security] 20110711 Re: vsftpd download backdoored x_refsource_MLIST mailing-list x_transferred
https://vigilance.fr/vulnerability/vsftpd-backdoor-in-version-2-3-4-10805 x_transferred x_refsource_MISC
https://packetstormsecurity.com/files/102745/VSFTPD-2.3.4-Backdoor-Command-Exec… x_transferred x_refsource_MISC
http://packetstormsecurity.com/files/162145/vsftpd-2.3.4-Backdoor-Command-Execu… x_transferred x_refsource_MISC
https://security-tracker.debian.org/tracker/CVE-2011-2523 x_refsource_MISC
https://access.redhat.com/security/cve/cve-2011-2523 x_refsource_MISC
[oss-security] 20110711 Re: vsftpd download backdoored x_refsource_MLIST mailing-list
https://vigilance.fr/vulnerability/vsftpd-backdoor-in-version-2-3-4-10805 x_refsource_MISC
https://packetstormsecurity.com/files/102745/VSFTPD-2.3.4-Backdoor-Command-Exec… x_refsource_MISC
http://packetstormsecurity.com/files/162145/vsftpd-2.3.4-Backdoor-Command-Execu… x_refsource_MISC
https://security-tracker.debian.org/tracker/CVE-2011-2523 x_transferred x_refsource_MISC
https://access.redhat.com/security/cve/cve-2011-2523 x_transferred x_refsource_MISC
[oss-security] 20110711 Re: vsftpd download backdoored x_refsource_MLIST mailing-list x_transferred
https://vigilance.fr/vulnerability/vsftpd-backdoor-in-version-2-3-4-10805 x_transferred x_refsource_MISC
https://packetstormsecurity.com/files/102745/VSFTPD-2.3.4-Backdoor-Command-Exec… x_transferred x_refsource_MISC
http://packetstormsecurity.com/files/162145/vsftpd-2.3.4-Backdoor-Command-Execu… x_transferred x_refsource_MISC

Affected products

vsftpd

==2.3.4 downloaded between 20110630 and 20110703

Matching in nixpkgs

pkgs.vsftpd

Very secure FTP daemon

nixos-unstable 3.0.5
- nixpkgs-unstable 3.0.5
- nixos-unstable-small 3.0.5
nixos-25.11 3.0.5
- nixos-25.11-small 3.0.5
- nixpkgs-25.11-darwin 3.0.5

Package maintainers

@peterhoeg Peter Hoeg <peter@hoeg.com>

Dismissed

Permalink CVE-2025-14242

6.5 MEDIUM

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): NONE
Integrity impact (I): NONE
Availability impact (A): HIGH

updated 2 months ago by @LeSuisse Activity log

Created automatic suggestion 2 months, 1 week ago
@LeSuisse dismissed 2 months ago

Vsftpd: vsftpd: denial of service via integer overflow in ls command parameter parsing

A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing, triggered by a remote, authenticated attacker sending a crafted STAT command with a specific byte sequence.

References

RHSA-2026:0605 vendor-advisory x_refsource_REDHAT
RHSA-2026:0606 vendor-advisory x_refsource_REDHAT
RHSA-2026:0608 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-14242 x_refsource_REDHAT vdb-entry
RHBZ#2419826 issue-tracking x_refsource_REDHAT
RHSA-2026:0605 vendor-advisory x_refsource_REDHAT
RHSA-2026:0606 vendor-advisory x_refsource_REDHAT
RHSA-2026:0608 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-14242 x_refsource_REDHAT vdb-entry
RHBZ#2419826 issue-tracking x_refsource_REDHAT

Affected products

vsftpd

*

Matching in nixpkgs

pkgs.vsftpd

Very secure FTP daemon

nixos-unstable 3.0.5
- nixpkgs-unstable 3.0.5
- nixos-unstable-small 3.0.5

Package maintainers

@peterhoeg Peter Hoeg <peter@hoeg.com>

Only impact a Red hat specific patch not shipped in nixpkgs

https://bugzilla.redhat.com/show_bug.cgi?id=2419826

1