Search for packages
Package details: pkg:deb/debian/lftp@4.3.6-1%2Bdeb7u2
purl pkg:deb/debian/lftp@4.3.6-1%2Bdeb7u2
Next non-vulnerable version 4.8.4-2
Latest non-vulnerable version 4.8.4-2
Risk 3.5
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-kkqc-jz9x-mycw
Aliases:
CVE-2018-10916
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
4.8.4-2
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2025-08-01T17:49:48.882373+00:00 Debian Oval Importer Affected by VCID-kkqc-jz9x-mycw https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0