Search for packages
| purl | pkg:deb/debian/lftp@4.0.6-1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-gc6j-hdbu-aaan
Aliases: CVE-2018-10916 |
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-4kvw-jbhm-aaae | The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory. |
CVE-2010-2251
|
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2025-06-21T16:47:59.365181+00:00 | Debian Oval Importer | Affected by | VCID-gc6j-hdbu-aaan | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.3 |
| 2025-06-21T13:44:36.895936+00:00 | Debian Oval Importer | Fixing | VCID-4kvw-jbhm-aaae | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.3 |
| 2025-06-20T21:42:15.204634+00:00 | Debian Oval Importer | Fixing | VCID-4kvw-jbhm-aaae | None | 36.1.3 |
| 2025-06-20T21:09:29.210566+00:00 | Debian Oval Importer | Affected by | VCID-gc6j-hdbu-aaan | None | 36.1.3 |
| 2025-06-08T12:51:44.992187+00:00 | Debian Oval Importer | Fixing | VCID-4kvw-jbhm-aaae | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.1.0 |
| 2025-06-08T09:33:14.978680+00:00 | Debian Oval Importer | Affected by | VCID-gc6j-hdbu-aaan | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.0 |
| 2025-06-08T06:38:48.814564+00:00 | Debian Oval Importer | Fixing | VCID-4kvw-jbhm-aaae | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.0 |
| 2025-06-07T15:05:06.524975+00:00 | Debian Oval Importer | Fixing | VCID-4kvw-jbhm-aaae | None | 36.1.0 |
| 2025-06-07T14:34:36.239328+00:00 | Debian Oval Importer | Affected by | VCID-gc6j-hdbu-aaan | None | 36.1.0 |
| 2025-04-12T20:50:44.015638+00:00 | Debian Oval Importer | Affected by | VCID-gc6j-hdbu-aaan | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-12T18:38:49.122939+00:00 | Debian Oval Importer | Fixing | VCID-4kvw-jbhm-aaae | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-08T08:05:36.533863+00:00 | Debian Oval Importer | Affected by | VCID-gc6j-hdbu-aaan | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-08T05:11:13.953495+00:00 | Debian Oval Importer | Fixing | VCID-4kvw-jbhm-aaae | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-07T13:36:54.395938+00:00 | Debian Oval Importer | Fixing | VCID-4kvw-jbhm-aaae | None | 36.0.0 |
| 2025-04-07T13:06:40.819066+00:00 | Debian Oval Importer | Affected by | VCID-gc6j-hdbu-aaan | None | 36.0.0 |
| 2024-11-27T17:50:23.773623+00:00 | Debian Oval Importer | Fixing | VCID-4kvw-jbhm-aaae | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 35.0.0 |
| 2024-10-13T10:53:06.517445+00:00 | Debian Oval Importer | Fixing | VCID-4kvw-jbhm-aaae | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 34.0.2 |
| 2024-09-20T22:41:21.420210+00:00 | Debian Oval Importer | Fixing | VCID-4kvw-jbhm-aaae | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 34.0.1 |