CLSA-2026-1784710881
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1784710881.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1784710881
- Upstream
CVE (2)
- Published
- 2026-07-22T09:01:49Z
- Modified
- 2026-10-26T09:31:52Z
- Summary
- Fix CVE(s): CVE-2026-47729, CVE-2026-50012
- Details
-
- SECURITY UPDATE: out-of-bounds read in the FTP gateway directory-listing
parser when a TypeA/TypeB listing entry date is not followed by a filename
- debian/patches/CVE-2026-47729.patch: restrict parsing to the input buffer in ftpListParseParts() by checking for a NUL byte before strchr(w_space) in src/clients/FtpGateway.cc
- CVE-2026-47729
- SECURITY UPDATE: heap-based buffer overflow in cache digest reply handling
when a peer reply's on-the-wire size exceeds the declared mask_size
- debian/patches/CVE-2026-50012.patch: bound-check mask_offset + size against mask_size before memcpy() in peerDigestSwapInMask() and abort the fetch on overflow in src/peer_digest.cc
- CVE-2026-50012
- SECURITY UPDATE: out-of-bounds read in the FTP gateway directory-listing
parser when a TypeA/TypeB listing entry date is not followed by a filename
- References