lftp vulnerability

Related Vulnerabilities: CVE-2018-10916  

LFTP could be made to crash if it received specially crafted file.

It was discovered that LFTP incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service.

6 August 2018

lftp vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

LFTP could be made to crash if it received specially crafted file.

Software Description

  • lftp - Sophisticated command-line FTP/HTTP/BitTorrent client programs

Details

It was discovered that LFTP incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.04 LTS
lftp - 4.8.1-1ubuntu0.1
Ubuntu 16.04 LTS
lftp - 4.6.3a-1ubuntu0.1
Ubuntu 14.04 LTS
lftp - 4.4.13-1ubuntu0.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References