Maintainer asked to be removed. PR: 9989630259911f
proftpd -- user chroot escape vulnerabilityentered 2017-07-27
Port details
ftp/proftpd1.3.8c_3
Highly configurable FTP daemon
- Maintainer
- mm@FreeBSD.org
- Packages
- proftpd 1.3.8c_3
- Upstream
- Higher version available: 1.3.9d
- CPE
proftpd:proftpdfrom the port- WWW
- http://www.proftpd.org/
- Links
- cgit · VuXML
Unaddressed (5) · The CVE record lists this version as affected, no VuXML entry names the CVE
Updating to 1.3.10 would fix 3 of 5 unaddressed CVEs, according to the CVE records.
Fixed up to each version, cumulative: 1.3.9c 2 · 1.3.10 3
| CVE-2026-63090 | 8.7 | 2026-07-20 | ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achie… |
| CVE-2026-35025 | 8.6 | 2026-06-24 | ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by pref… |
| CVE-2026-42167 | 8.1 | 2026-04-28 | mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion… |
| CVE-2026-53994 | 7.7 | 2026-07-18 | ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-e… |
| CVE-2026-63091 | 7.1 | 2026-07-20 | ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows authenticated low-privil… |
VuXML only (0) · listed, port not fixed yet
None.
pkg audit reports nothing for this version.Fixed (13)
Show 13 fixed
VuXML entries whose affected range this version has left.
proftpd -- vulnerability in mod_tlsentered 2016-04-20
proftpd -- arbitrary code execution vulnerability with chrootentered 2015-05-20
proftpd -- arbitrary code execution vulnerability with chrootentered 2011-12-23
no CVE referenced
proftpd -- Compromised source packages backdoorentered 2010-12-04
no CVE referenced
proftpd -- remote code execution vulnerabilityentered 2010-11-23
proftpd -- multiple sql injection vulnerabilitiesentered 2009-03-16
proftpd -- Long Command Processing Vulnerabilityentered 2008-09-23
proftpd -- remote code execution vulnerabilitiesentered 2006-12-21
proftpd -- Remote Code Execution Vulnerabilityentered 2006-11-14
no CVE referenced
proftpd -- format string vulnerabilitiesentered 2005-08-03
proftpd IP address access control list breakageentered 2004-05-02
ProFTPD ASCII translation bug resulting in remote root compromiseentered 2004-01-05
Commits (312)
Update to version 1.2.0pre3. PR: 10830 Submitted by: Micahel Haro <mharo@area51.fremont.ca.us>145bda6b61
Update to version 1.2.0pre2. PR: 10186 Submitted by: Michael Haro <mharo@area51.fremont.ca.us>7bbff91f09
add buffer overflow vulnerability reduction patch Submitted by: Michael <mharo@area51.fremont.ca.us>a9737b005f
No need to use += for variable defined only once.f493d483bc
Upgrade to 1.2.0, and associated changes.f7a48aefbc
This netted the largest set of mis-installed manpages, yet!26e78bb69f
Enabling anonymous ftp in proftpd can be confusing with the average setup PR: ports/6982 Submitted by: Bill Fumerola <billf@chc-chimes.com>72c321b422
Upgrade to version 1.0.3pl1. PR: 6884 Submitted by: maintainer6e7b3ce4b7
Make this thing syslog(3) like the stock ftpd(8). We now use facility FTP vs. DAEMON, and many LOG_NOTICEs were down graded to LOG_INFO. Out of the box, this thing will fill your `messages' file so full, you'd never see anything else in it again, on a busy ftp server.0cfd42308a
Make manpages reflect reality as far as files' paths go. Put control file `shutmsg' in /var/run, not /etc7f27b5ae41
proftpd is a highly configurable ftp daemon. PR: ports/5588 Submitted by: Stephane Legrand <stephane@lituus.fr>c832199dd9