Search for packages
Package details: pkg:deb/debian/lftp@3.5.6-1
purl pkg:deb/debian/lftp@3.5.6-1
Next non-vulnerable version 4.8.4-2
Latest non-vulnerable version 4.8.4-2
Risk 3.5
Vulnerabilities affecting this package (3)
Vulnerability Summary Fixed by
VCID-4kvw-jbhm-aaae
Aliases:
CVE-2010-2251
The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
4.0.6-1
Affected by 1 other vulnerability.
VCID-efv9-xs74-aaae
Aliases:
CVE-2007-2348
mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execute shell commands via a malicious script. NOTE: it is not clear whether this issue crosses security boundaries, since the script already supports commands such as "get" which could overwrite executable files.
3.7.3-1+lenny1
Affected by 2 other vulnerabilities.
VCID-gc6j-hdbu-aaan
Aliases:
CVE-2018-10916
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
4.8.4-2
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2025-06-21T18:18:20.175470+00:00 Debian Oval Importer Affected by VCID-efv9-xs74-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.1.3
2025-06-21T16:47:59.361511+00:00 Debian Oval Importer Affected by VCID-gc6j-hdbu-aaan https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.3
2025-06-21T14:34:59.711791+00:00 Debian Oval Importer Affected by VCID-efv9-xs74-aaae https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.3
2025-06-21T13:44:36.891487+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.3
2025-06-21T01:31:21.874742+00:00 Debian Oval Importer Affected by VCID-efv9-xs74-aaae None 36.1.3
2025-06-20T21:42:15.200378+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae None 36.1.3
2025-06-20T21:09:29.207394+00:00 Debian Oval Importer Affected by VCID-gc6j-hdbu-aaan None 36.1.3
2025-06-08T12:51:44.988805+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.1.0
2025-06-08T10:49:20.602896+00:00 Debian Oval Importer Affected by VCID-efv9-xs74-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.1.0
2025-06-08T09:33:14.975716+00:00 Debian Oval Importer Affected by VCID-gc6j-hdbu-aaan https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.0
2025-06-08T07:28:05.020675+00:00 Debian Oval Importer Affected by VCID-efv9-xs74-aaae https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.0
2025-06-08T06:38:48.810755+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.0
2025-06-07T18:54:19.275316+00:00 Debian Oval Importer Affected by VCID-efv9-xs74-aaae None 36.1.0
2025-06-07T15:05:06.521739+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae None 36.1.0
2025-06-07T14:34:36.236300+00:00 Debian Oval Importer Affected by VCID-gc6j-hdbu-aaan None 36.1.0
2025-04-12T20:50:44.005849+00:00 Debian Oval Importer Affected by VCID-gc6j-hdbu-aaan https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-12T18:38:49.112807+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-12T16:31:34.100536+00:00 Debian Oval Importer Affected by VCID-efv9-xs74-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-08T08:05:36.524184+00:00 Debian Oval Importer Affected by VCID-gc6j-hdbu-aaan https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.0.0
2025-04-08T06:00:54.262000+00:00 Debian Oval Importer Affected by VCID-efv9-xs74-aaae https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.0.0
2025-04-08T05:11:13.943427+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.0.0
2025-04-07T17:32:10.163355+00:00 Debian Oval Importer Affected by VCID-efv9-xs74-aaae None 36.0.0
2025-04-07T13:36:54.385944+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae None 36.0.0
2025-04-07T13:06:40.807458+00:00 Debian Oval Importer Affected by VCID-gc6j-hdbu-aaan None 36.0.0
2024-11-27T17:50:23.762892+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 35.0.0
2024-11-26T03:04:05.537025+00:00 Debian Oval Importer Affected by VCID-efv9-xs74-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 35.0.0
2024-10-13T10:53:06.507820+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 34.0.2
2024-10-12T08:44:27.432880+00:00 Debian Oval Importer Affected by VCID-efv9-xs74-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 34.0.2
2024-09-20T22:41:21.405675+00:00 Debian Oval Importer Affected by VCID-4kvw-jbhm-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 34.0.1
2024-09-20T13:48:06.551396+00:00 Debian Oval Importer Affected by VCID-efv9-xs74-aaae https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 34.0.1