Search for packages
Package details: pkg:deb/debian/lftp@3.7.3-1%2Blenny1
purl pkg:deb/debian/lftp@3.7.3-1%2Blenny1
Next non-vulnerable version 4.8.4-2
Latest non-vulnerable version 4.8.4-2
Risk 3.5
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-4kvw-jbhm-aaae
Aliases:
CVE-2010-2251
The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
4.0.6-1
Affected by 1 other vulnerability.
VCID-gc6j-hdbu-aaan
Aliases:
CVE-2018-10916
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
4.8.4-2
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-efv9-xs74-aaae mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execute shell commands via a malicious script. NOTE: it is not clear whether this issue crosses security boundaries, since the script already supports commands such as "get" which could overwrite executable files. CVE-2007-2348

Date Actor Action Vulnerability Source VulnerableCode Version
2025-06-21T18:18:20.177200+00:00 Debian Oval Importer Fixing VCID-efv9-xs74-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.1.3
2025-06-21T16:47:59.363356+00:00 Debian Oval Importer Affected by VCID-gc6j-hdbu-aaan https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.3
2025-06-21T14:34:59.713670+00:00 Debian Oval Importer Fixing VCID-efv9-xs74-aaae https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.3
2025-06-21T13:44:36.893694+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.3
2025-06-21T01:31:21.876884+00:00 Debian Oval Importer Fixing VCID-efv9-xs74-aaae None 36.1.3
2025-06-20T21:42:15.202625+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae None 36.1.3
2025-06-20T21:09:29.208991+00:00 Debian Oval Importer Affected by VCID-gc6j-hdbu-aaan None 36.1.3
2025-06-08T12:51:44.990628+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.1.0
2025-06-08T10:49:20.604483+00:00 Debian Oval Importer Fixing VCID-efv9-xs74-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.1.0
2025-06-08T09:33:14.977196+00:00 Debian Oval Importer Affected by VCID-gc6j-hdbu-aaan https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.0
2025-06-08T07:28:05.022234+00:00 Debian Oval Importer Fixing VCID-efv9-xs74-aaae https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.0
2025-06-08T06:38:48.812787+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.0
2025-06-07T18:54:19.276910+00:00 Debian Oval Importer Fixing VCID-efv9-xs74-aaae None 36.1.0
2025-06-07T15:05:06.523240+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae None 36.1.0
2025-06-07T14:34:36.237805+00:00 Debian Oval Importer Affected by VCID-gc6j-hdbu-aaan None 36.1.0
2025-04-12T20:50:44.010758+00:00 Debian Oval Importer Affected by VCID-gc6j-hdbu-aaan https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-12T18:38:49.117908+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-12T16:31:34.105499+00:00 Debian Oval Importer Fixing VCID-efv9-xs74-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-08T08:05:36.528990+00:00 Debian Oval Importer Affected by VCID-gc6j-hdbu-aaan https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.0.0
2025-04-08T06:00:54.267064+00:00 Debian Oval Importer Fixing VCID-efv9-xs74-aaae https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.0.0
2025-04-08T05:11:13.948479+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.0.0
2025-04-07T17:32:10.168263+00:00 Debian Oval Importer Fixing VCID-efv9-xs74-aaae None 36.0.0
2025-04-07T13:36:54.390936+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae None 36.0.0
2025-04-07T13:06:40.813260+00:00 Debian Oval Importer Affected by VCID-gc6j-hdbu-aaan None 36.0.0
2024-11-27T17:50:23.767696+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 35.0.0
2024-11-26T03:04:05.542061+00:00 Debian Oval Importer Fixing VCID-efv9-xs74-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 35.0.0
2024-10-13T10:53:06.512620+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 34.0.2
2024-10-12T08:44:27.437644+00:00 Debian Oval Importer Fixing VCID-efv9-xs74-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 34.0.2
2024-09-20T22:41:21.412039+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 34.0.1
2024-09-20T13:48:06.556159+00:00 Debian Oval Importer Fixing VCID-efv9-xs74-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 34.0.1