CVE-2006-6652: Apple Mac OS X

High severity, CVSS 9.0. EPSS: 20% chance of exploitation in the next 30 days.

Buffer overflow in the glob implementation (glob.c) in libc in NetBSD-current before 20050914, NetBSD 2.* and 3.* before 20061203, and Apple Mac OS X before 2007-004, as used by the FTP daemon and tnftpd, allows remote authenticated users to execute arbitrary code via a long pathname that results from path expansion.

Affected products

• Apple Mac OS X: version 10.0 only; version 10.0.1 only; version 10.0.2 only; version 10.0.3 only; version 10.0.4 only; version 10.1 only; …
• Netbsd Netbsd: version 2.0 only; version 2.1 only; version 3.0 only; version 3.1 only

Published 2006-12-20. Last modified 2026-06-16.