CVE-2011-0762: Canonical Ubuntu Linux

Medium severity, CVSS 4.0. EPSS: 73.9% chance of exploitation in the next 30 days.

The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 8.04 only; version 9.10 only; version 10.04 only; version 10.10 only
• Debian Debian Linux: version 5.0 only; version 6.0 only; version 7.0 only
• Fedoraproject Fedora: version 13 only; version 14 only; version 15 only
• Opensuse Opensuse: version 11.2 only; version 11.3 only; version 11.4 only
• Suse Linux Enterprise Server: version 9 only; version 10 only; version 11 only
• Vsftpd Project Vsftpd: before 2.3.3 (fixed in 2.3.3)

Published 2011-03-02. Last modified 2026-06-16.