In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not anticipate an initial -1 value. (Versions 1.0.23 through 1.0.49 are affected.)
{ "binaries": [ { "binary_version": "1.0.36-3.2+deb8u1build0.16.04.1", "binary_name": "pure-ftpd" }, { "binary_version": "1.0.36-3.2+deb8u1build0.16.04.1", "binary_name": "pure-ftpd-common" }, { "binary_version": "1.0.36-3.2+deb8u1build0.16.04.1", "binary_name": "pure-ftpd-ldap" }, { "binary_version": "1.0.36-3.2+deb8u1build0.16.04.1", "binary_name": "pure-ftpd-mysql" }, { "binary_version": "1.0.36-3.2+deb8u1build0.16.04.1", "binary_name": "pure-ftpd-postgresql" } ] }
{ "binaries": [ { "binary_version": "1.0.46-1ubuntu18.04.1", "binary_name": "pure-ftpd" }, { "binary_version": "1.0.46-1ubuntu18.04.1", "binary_name": "pure-ftpd-common" }, { "binary_version": "1.0.46-1ubuntu18.04.1", "binary_name": "pure-ftpd-ldap" }, { "binary_version": "1.0.46-1ubuntu18.04.1", "binary_name": "pure-ftpd-mysql" }, { "binary_version": "1.0.46-1ubuntu18.04.1", "binary_name": "pure-ftpd-postgresql" } ] }
{ "binaries": [ { "binary_version": "1.0.49-4ubuntu0.1", "binary_name": "pure-ftpd" }, { "binary_version": "1.0.49-4ubuntu0.1", "binary_name": "pure-ftpd-common" }, { "binary_version": "1.0.49-4ubuntu0.1", "binary_name": "pure-ftpd-ldap" }, { "binary_version": "1.0.49-4ubuntu0.1", "binary_name": "pure-ftpd-mysql" }, { "binary_version": "1.0.49-4ubuntu0.1", "binary_name": "pure-ftpd-postgresql" } ] }
{ "binaries": [ { "binary_version": "1.0.50-2.1ubuntu0.22.04.1", "binary_name": "pure-ftpd" }, { "binary_version": "1.0.50-2.1ubuntu0.22.04.1", "binary_name": "pure-ftpd-common" }, { "binary_version": "1.0.50-2.1ubuntu0.22.04.1", "binary_name": "pure-ftpd-ldap" }, { "binary_version": "1.0.50-2.1ubuntu0.22.04.1", "binary_name": "pure-ftpd-mysql" }, { "binary_version": "1.0.50-2.1ubuntu0.22.04.1", "binary_name": "pure-ftpd-postgresql" } ] }
{ "binaries": [ { "binary_version": "1.0.50-2.2build2", "binary_name": "pure-ftpd" }, { "binary_version": "1.0.50-2.2build2", "binary_name": "pure-ftpd-common" }, { "binary_version": "1.0.50-2.2build2", "binary_name": "pure-ftpd-ldap" }, { "binary_version": "1.0.50-2.2build2", "binary_name": "pure-ftpd-mysql" }, { "binary_version": "1.0.50-2.2build2", "binary_name": "pure-ftpd-postgresql" } ] }
{ "binaries": [ { "binary_version": "1.0.50-2.2build3", "binary_name": "pure-ftpd" }, { "binary_version": "1.0.50-2.2build3", "binary_name": "pure-ftpd-common" }, { "binary_version": "1.0.50-2.2build3", "binary_name": "pure-ftpd-ldap" }, { "binary_version": "1.0.50-2.2build3", "binary_name": "pure-ftpd-mysql" }, { "binary_version": "1.0.50-2.2build3", "binary_name": "pure-ftpd-postgresql" } ] }