{"id":"SUSE-SU-2026:5181-1","summary":"Security update for proftpd","details":"This update for proftpd fixes the following issues:\n\n- Authenticated SFTP sessions can overflow the SFTP packet buffer (bsc#1271096).\n- CVE-2026-35025: access control bypass allows authenticated FTP users to circumvent Directory ACL restrictions by\n  prefixing paths with `/proc/self/root` in the RNFR command handler (bsc#1269065).\n- CVE-2026-42167: `mod_sql` allows remote attackers to execute arbitrary code via a username when there is logging of\n  `USER` requests with an expansion such as `%U` and the SQL backend allows `comman` (bsc#1263183).\n- CVE-2026-44331: SQL injection in `sqltab_fetch_clients_cb()` in `contrib/mod_wrap2_sql.c` triggered via crafted domain\n  name from reverse DNS lookup (bsc#1264262).\n- CVE-2026-53994: heap-based buffer overflow reachable by an authenticated SFTP user can lead to denial of service and\n  memory corruption (bsc#1271946).\n- CVE-2026-63090: heap-based buffer overflow in the `mod_sftp` module can lead to arbitrary code execution via crafted\n  SFTP packet fragments (bsc#1271944).\n- CVE-2026-63091: signed integer overflow in the `mod_sftp` module's SCP size-record parser can lead to ASLR bypass via\n  a crafted file size value of `UINT64_MAX` (bsc#1271945).\n- CVE-2026-119147: authorization bypass in the `mod_sftp` copy-file extension handler allows SFTP users to copy any\n  readable file to a new path in write-denied directories (bsc#1289272).\n- Integer overflow via client-provided file size for SCP uploads (bsc#1271097).\n","modified":"2026-11-11T13:00:04.395234588Z","published":"2026-11-10T17:39:43Z","related":["CVE-2026-119147","CVE-2026-35025","CVE-2026-42167","CVE-2026-44331","CVE-2026-53994","CVE-2026-63090","CVE-2026-63091"],"upstream":["CVE-2026-119147","CVE-2026-35025","CVE-2026-42167","CVE-2026-44331","CVE-2026-53994","CVE-2026-63090","CVE-2026-63091"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265181-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1263183"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264262"},{"type":"REPORT","url":"https://bugzilla.suse.com/1269065"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271096"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271097"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271944"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271945"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271946"},{"type":"REPORT","url":"https://bugzilla.suse.com/1289272"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-119147"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-35025"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-42167"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-44331"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-53994"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-63090"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-63091"}],"affected":[{"package":{"name":"proftpd","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","purl":"pkg:rpm/suse/proftpd&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8b-150600.13.18.1"}]}],"ecosystem_specific":{"binaries":[{"proftpd-mysql":"1.3.8b-150600.13.18.1","proftpd-pgsql":"1.3.8b-150600.13.18.1","proftpd-lang":"1.3.8b-150600.13.18.1","proftpd-sqlite":"1.3.8b-150600.13.18.1","proftpd-devel":"1.3.8b-150600.13.18.1","proftpd-doc":"1.3.8b-150600.13.18.1","proftpd-radius":"1.3.8b-150600.13.18.1","proftpd-ldap":"1.3.8b-150600.13.18.1","proftpd":"1.3.8b-150600.13.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5181-1.json"}},{"package":{"name":"proftpd","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","purl":"pkg:rpm/suse/proftpd&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8b-150600.13.18.1"}]}],"ecosystem_specific":{"binaries":[{"proftpd-mysql":"1.3.8b-150600.13.18.1","proftpd":"1.3.8b-150600.13.18.1","proftpd-pgsql":"1.3.8b-150600.13.18.1","proftpd-radius":"1.3.8b-150600.13.18.1","proftpd-ldap":"1.3.8b-150600.13.18.1","proftpd-lang":"1.3.8b-150600.13.18.1","proftpd-sqlite":"1.3.8b-150600.13.18.1","proftpd-doc":"1.3.8b-150600.13.18.1","proftpd-devel":"1.3.8b-150600.13.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5181-1.json"}},{"package":{"name":"proftpd","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","purl":"pkg:rpm/suse/proftpd&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8b-150600.13.18.1"}]}],"ecosystem_specific":{"binaries":[{"proftpd-pgsql":"1.3.8b-150600.13.18.1","proftpd":"1.3.8b-150600.13.18.1","proftpd-devel":"1.3.8b-150600.13.18.1","proftpd-doc":"1.3.8b-150600.13.18.1","proftpd-ldap":"1.3.8b-150600.13.18.1","proftpd-mysql":"1.3.8b-150600.13.18.1","proftpd-sqlite":"1.3.8b-150600.13.18.1","proftpd-lang":"1.3.8b-150600.13.18.1","proftpd-radius":"1.3.8b-150600.13.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5181-1.json"}}],"schema_version":"1.9.2"}