Nixpkgs Security Tracker

Permalink CVE-2025-14242

6.5 MEDIUM

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): NONE
Integrity impact (I): NONE
Availability impact (A): HIGH

updated 2 months ago by @LeSuisse Activity log

Created automatic suggestion 2 months, 1 week ago
@LeSuisse dismissed 2 months ago

Vsftpd: vsftpd: denial of service via integer overflow in ls command parameter parsing

A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing, triggered by a remote, authenticated attacker sending a crafted STAT command with a specific byte sequence.

References

RHSA-2026:0605 vendor-advisory x_refsource_REDHAT
RHSA-2026:0606 vendor-advisory x_refsource_REDHAT
RHSA-2026:0608 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-14242 x_refsource_REDHAT vdb-entry
RHBZ#2419826 issue-tracking x_refsource_REDHAT
RHSA-2026:0605 vendor-advisory x_refsource_REDHAT
RHSA-2026:0606 vendor-advisory x_refsource_REDHAT
RHSA-2026:0608 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-14242 x_refsource_REDHAT vdb-entry
RHBZ#2419826 issue-tracking x_refsource_REDHAT

Affected products

vsftpd

Matching in nixpkgs

pkgs.vsftpd

Very secure FTP daemon

nixos-unstable 3.0.5
- nixpkgs-unstable 3.0.5
- nixos-unstable-small 3.0.5

Package maintainers

@peterhoeg Peter Hoeg <peter@hoeg.com>

Only impact a Red hat specific patch not shipped in nixpkgs

https://bugzilla.redhat.com/show_bug.cgi?id=2419826

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.vsftpd

Package maintainers