CVE-2020-9273 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2020-9273 Interim 1 20 2025-08-14T01:43:55Z current 2021-05-30T14:38:16Z 2025-08-14T01:43:55Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2020-9273 In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NWEO4RUNNDPDSIHIS6CBC7B43G6TT4FO/ E-Mail link for openSUSE-SU-2020:0273-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Package Hub 15 SUSE Package Hub 15 SP1 openSUSE Leap 15.1 openSUSE Tumbleweed proftpd-1.3.6c-bp150.3.9.1 proftpd-1.3.6c-bp151.4.9.1 proftpd-1.3.6c-lp151.3.9.1 proftpd-1.3.6e-1.10 proftpd-1.3.8b-150600.13.6.1 proftpd-devel-1.3.6c-bp150.3.9.1 proftpd-devel-1.3.6c-bp151.4.9.1 proftpd-devel-1.3.6c-lp151.3.9.1 proftpd-devel-1.3.6e-1.10 proftpd-devel-1.3.8b-150600.13.6.1 proftpd-doc-1.3.6c-bp150.3.9.1 proftpd-doc-1.3.6c-bp151.4.9.1 proftpd-doc-1.3.6c-lp151.3.9.1 proftpd-doc-1.3.6e-1.10 proftpd-doc-1.3.8b-150600.13.6.1 proftpd-lang-1.3.6c-bp150.3.9.1 proftpd-lang-1.3.6c-bp151.4.9.1 proftpd-lang-1.3.6c-lp151.3.9.1 proftpd-lang-1.3.6e-1.10 proftpd-lang-1.3.8b-150600.13.6.1 proftpd-ldap-1.3.6c-bp150.3.9.1 proftpd-ldap-1.3.6c-bp151.4.9.1 proftpd-ldap-1.3.6c-lp151.3.9.1 proftpd-ldap-1.3.6e-1.10 proftpd-ldap-1.3.8b-150600.13.6.1 proftpd-mysql-1.3.6c-bp150.3.9.1 proftpd-mysql-1.3.6c-bp151.4.9.1 proftpd-mysql-1.3.6c-lp151.3.9.1 proftpd-mysql-1.3.6e-1.10 proftpd-mysql-1.3.8b-150600.13.6.1 proftpd-pgsql-1.3.6c-bp150.3.9.1 proftpd-pgsql-1.3.6c-bp151.4.9.1 proftpd-pgsql-1.3.6c-lp151.3.9.1 proftpd-pgsql-1.3.6e-1.10 proftpd-pgsql-1.3.8b-150600.13.6.1 proftpd-radius-1.3.6c-bp150.3.9.1 proftpd-radius-1.3.6c-bp151.4.9.1 proftpd-radius-1.3.6c-lp151.3.9.1 proftpd-radius-1.3.6e-1.10 proftpd-radius-1.3.8b-150600.13.6.1 proftpd-sqlite-1.3.6c-bp150.3.9.1 proftpd-sqlite-1.3.6c-bp151.4.9.1 proftpd-sqlite-1.3.6c-lp151.3.9.1 proftpd-sqlite-1.3.6e-1.10 proftpd-sqlite-1.3.8b-150600.13.6.1 proftpd-1.3.8b-150600.13.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 proftpd-devel-1.3.8b-150600.13.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 proftpd-doc-1.3.8b-150600.13.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 proftpd-lang-1.3.8b-150600.13.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 proftpd-ldap-1.3.8b-150600.13.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 proftpd-mysql-1.3.8b-150600.13.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 proftpd-pgsql-1.3.8b-150600.13.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 proftpd-radius-1.3.8b-150600.13.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 proftpd-sqlite-1.3.8b-150600.13.6.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 proftpd-1.3.6c-bp150.3.9.1 as a component of SUSE Package Hub 15 proftpd-devel-1.3.6c-bp150.3.9.1 as a component of SUSE Package Hub 15 proftpd-doc-1.3.6c-bp150.3.9.1 as a component of SUSE Package Hub 15 proftpd-lang-1.3.6c-bp150.3.9.1 as a component of SUSE Package Hub 15 proftpd-ldap-1.3.6c-bp150.3.9.1 as a component of SUSE Package Hub 15 proftpd-mysql-1.3.6c-bp150.3.9.1 as a component of SUSE Package Hub 15 proftpd-pgsql-1.3.6c-bp150.3.9.1 as a component of SUSE Package Hub 15 proftpd-radius-1.3.6c-bp150.3.9.1 as a component of SUSE Package Hub 15 proftpd-sqlite-1.3.6c-bp150.3.9.1 as a component of SUSE Package Hub 15 proftpd-1.3.6c-bp151.4.9.1 as a component of SUSE Package Hub 15 SP1 proftpd-devel-1.3.6c-bp151.4.9.1 as a component of SUSE Package Hub 15 SP1 proftpd-doc-1.3.6c-bp151.4.9.1 as a component of SUSE Package Hub 15 SP1 proftpd-lang-1.3.6c-bp151.4.9.1 as a component of SUSE Package Hub 15 SP1 proftpd-ldap-1.3.6c-bp151.4.9.1 as a component of SUSE Package Hub 15 SP1 proftpd-mysql-1.3.6c-bp151.4.9.1 as a component of SUSE Package Hub 15 SP1 proftpd-pgsql-1.3.6c-bp151.4.9.1 as a component of SUSE Package Hub 15 SP1 proftpd-radius-1.3.6c-bp151.4.9.1 as a component of SUSE Package Hub 15 SP1 proftpd-sqlite-1.3.6c-bp151.4.9.1 as a component of SUSE Package Hub 15 SP1 proftpd-1.3.6c-lp151.3.9.1 as a component of openSUSE Leap 15.1 proftpd-devel-1.3.6c-lp151.3.9.1 as a component of openSUSE Leap 15.1 proftpd-doc-1.3.6c-lp151.3.9.1 as a component of openSUSE Leap 15.1 proftpd-lang-1.3.6c-lp151.3.9.1 as a component of openSUSE Leap 15.1 proftpd-ldap-1.3.6c-lp151.3.9.1 as a component of openSUSE Leap 15.1 proftpd-mysql-1.3.6c-lp151.3.9.1 as a component of openSUSE Leap 15.1 proftpd-pgsql-1.3.6c-lp151.3.9.1 as a component of openSUSE Leap 15.1 proftpd-radius-1.3.6c-lp151.3.9.1 as a component of openSUSE Leap 15.1 proftpd-sqlite-1.3.6c-lp151.3.9.1 as a component of openSUSE Leap 15.1 proftpd-1.3.6e-1.10 as a component of openSUSE Tumbleweed proftpd-devel-1.3.6e-1.10 as a component of openSUSE Tumbleweed proftpd-doc-1.3.6e-1.10 as a component of openSUSE Tumbleweed proftpd-lang-1.3.6e-1.10 as a component of openSUSE Tumbleweed proftpd-ldap-1.3.6e-1.10 as a component of openSUSE Tumbleweed proftpd-mysql-1.3.6e-1.10 as a component of openSUSE Tumbleweed proftpd-pgsql-1.3.6e-1.10 as a component of openSUSE Tumbleweed proftpd-radius-1.3.6e-1.10 as a component of openSUSE Tumbleweed proftpd-sqlite-1.3.6e-1.10 as a component of openSUSE Tumbleweed In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution. CVE-2020-9273 SUSE Linux Enterprise Module for Server Applications 15 SP7:proftpd-1.3.8b-150600.13.6.1 SUSE Linux Enterprise Module for Server Applications 15 SP7:proftpd-devel-1.3.8b-150600.13.6.1 SUSE Linux Enterprise Module for Server Applications 15 SP7:proftpd-doc-1.3.8b-150600.13.6.1 SUSE Linux Enterprise Module for Server Applications 15 SP7:proftpd-lang-1.3.8b-150600.13.6.1 SUSE Linux Enterprise Module for Server Applications 15 SP7:proftpd-ldap-1.3.8b-150600.13.6.1 SUSE Linux Enterprise Module for Server Applications 15 SP7:proftpd-mysql-1.3.8b-150600.13.6.1 SUSE Linux Enterprise Module for Server Applications 15 SP7:proftpd-pgsql-1.3.8b-150600.13.6.1 SUSE Linux Enterprise Module for Server Applications 15 SP7:proftpd-radius-1.3.8b-150600.13.6.1 SUSE Linux Enterprise Module for Server Applications 15 SP7:proftpd-sqlite-1.3.8b-150600.13.6.1 SUSE Package Hub 15:proftpd-1.3.6c-bp150.3.9.1 SUSE Package Hub 15:proftpd-devel-1.3.6c-bp150.3.9.1 SUSE Package Hub 15:proftpd-doc-1.3.6c-bp150.3.9.1 SUSE Package Hub 15:proftpd-lang-1.3.6c-bp150.3.9.1 SUSE Package Hub 15:proftpd-ldap-1.3.6c-bp150.3.9.1 SUSE Package Hub 15:proftpd-mysql-1.3.6c-bp150.3.9.1 SUSE Package Hub 15:proftpd-pgsql-1.3.6c-bp150.3.9.1 SUSE Package Hub 15:proftpd-radius-1.3.6c-bp150.3.9.1 SUSE Package Hub 15:proftpd-sqlite-1.3.6c-bp150.3.9.1 SUSE Package Hub 15 SP1:proftpd-1.3.6c-bp151.4.9.1 SUSE Package Hub 15 SP1:proftpd-devel-1.3.6c-bp151.4.9.1 SUSE Package Hub 15 SP1:proftpd-doc-1.3.6c-bp151.4.9.1 SUSE Package Hub 15 SP1:proftpd-lang-1.3.6c-bp151.4.9.1 SUSE Package Hub 15 SP1:proftpd-ldap-1.3.6c-bp151.4.9.1 SUSE Package Hub 15 SP1:proftpd-mysql-1.3.6c-bp151.4.9.1 SUSE Package Hub 15 SP1:proftpd-pgsql-1.3.6c-bp151.4.9.1 SUSE Package Hub 15 SP1:proftpd-radius-1.3.6c-bp151.4.9.1 SUSE Package Hub 15 SP1:proftpd-sqlite-1.3.6c-bp151.4.9.1 openSUSE Leap 15.1:proftpd-1.3.6c-lp151.3.9.1 openSUSE Leap 15.1:proftpd-devel-1.3.6c-lp151.3.9.1 openSUSE Leap 15.1:proftpd-doc-1.3.6c-lp151.3.9.1 openSUSE Leap 15.1:proftpd-lang-1.3.6c-lp151.3.9.1 openSUSE Leap 15.1:proftpd-ldap-1.3.6c-lp151.3.9.1 openSUSE Leap 15.1:proftpd-mysql-1.3.6c-lp151.3.9.1 openSUSE Leap 15.1:proftpd-pgsql-1.3.6c-lp151.3.9.1 openSUSE Leap 15.1:proftpd-radius-1.3.6c-lp151.3.9.1 openSUSE Leap 15.1:proftpd-sqlite-1.3.6c-lp151.3.9.1 openSUSE Tumbleweed:proftpd-1.3.6e-1.10 openSUSE Tumbleweed:proftpd-devel-1.3.6e-1.10 openSUSE Tumbleweed:proftpd-doc-1.3.6e-1.10 openSUSE Tumbleweed:proftpd-lang-1.3.6e-1.10 openSUSE Tumbleweed:proftpd-ldap-1.3.6e-1.10 openSUSE Tumbleweed:proftpd-mysql-1.3.6e-1.10 openSUSE Tumbleweed:proftpd-pgsql-1.3.6e-1.10 openSUSE Tumbleweed:proftpd-radius-1.3.6e-1.10 openSUSE Tumbleweed:proftpd-sqlite-1.3.6e-1.10 important 9 AV:N/AC:L/Au:S/C:C/I:C/A:C 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H