This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-9274 →

DEBIAN-CVE-2020-9274

An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_...

Original description

The description as published by the source.

An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_alias(const char alias) or print_aliases(void) function is called, they fail to correctly detect the end of the linked list and try to access a non-existent list member. This is related to init_aliases in diraliases.c.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 pure-ftpd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.49-4"}]}]

Debian:13 pure-ftpd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.49-4"}]}]

References

advisory security-tracker.debian.org