CVE-2020-9273: Debian Linux

High severity, CVSS 8.8. EPSS: 12.1% chance of exploitation in the next 30 days.

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 30 only; version 31 only
• Opensuse Backports Sle: version 15.0 only
• Opensuse Leap: version 15.1 only
• ProFTPD ProFTPD: version 1.3.7 only
• Siemens SIMATIC Net CP 1543-1 Firmware: before 3.0 (fixed in 3.0)
• Siemens SIMATIC Net CP 1545-1 Firmware: affected versions not specified

Published 2020-02-20. Last modified 2026-06-17.