CVE-2011-0762
NoneCVSS
—
EPSS
73.9%
Published
Mar 2, 2011
CISA due date
—
The record
The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | vsftpd | 0 | 2.3.4-1 |
| Debian:12 | vsftpd | 0 | 2.3.4-1 |
| Debian:13 | vsftpd | 0 | 2.3.4-1 |
| Debian:5.0 | vsftpd | 0 | 2.0.7-1+lenny1 |
| Debian:6.0 | vsftpd | 0 | 2.3.2-3+squeeze2 |
| Red Hat:enterprise_linux:4::as | vsftpd | 0 | 0:2.0.1-9.el4 |
| Red Hat:enterprise_linux:4::as | vsftpd-debuginfo | 0 | 0:2.0.1-9.el4 |
| Red Hat:enterprise_linux:4::es | vsftpd | 0 | 0:2.0.1-9.el4 |
| Red Hat:enterprise_linux:4::es | vsftpd-debuginfo | 0 | 0:2.0.1-9.el4 |
| Red Hat:enterprise_linux:5::server | vsftpd | 0 | 0:2.0.5-16.el5_6.1 |
| Red Hat:enterprise_linux:5::server | vsftpd-debuginfo | 0 | 0:2.0.5-16.el5_6.1 |
| Red Hat:enterprise_linux:6::server | vsftpd | 0 | 0:2.2.2-6.el6_0.1 |
| Red Hat:enterprise_linux:6::server | vsftpd-debuginfo | 0 | 0:2.2.2-6.el6_0.1 |
| Red Hat:enterprise_linux:6::workstation | vsftpd | 0 | 0:2.2.2-6.el6_0.1 |
| Red Hat:enterprise_linux:6::workstation | vsftpd-debuginfo | 0 | 0:2.2.2-6.el6_0.1 |
Related vulnerabilities
- CVE-2011-2189 net/core/net_namespace.c in the Linux kernel 2.6.32 and earlier does not properly handle… Also affects vsftpd
- CVE-2007-5962 Memory leak in a certain Red Hat patch, applied to vsftpd 2.0.5 on Red Hat Enterprise… Also affects vsftpd
- CVE-2026-113795 pypdf is a free and open-source pure-python PDF library. CWE-400
- CVE-2026-83400 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-400
- CVE-2026-112400 Pillow is a Python imaging library. CWE-400
- CVE-2026-111766 markdown-it is a Markdown parser. CWE-400
- CVE-2026-111759 markdown-it is a Markdown parser. CWE-400
- CVE-2025-52290 A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg… CWE-400