CVE-2020-9274: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 6% chance of exploitation in the next 30 days.

An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_alias(const char alias) or print_aliases(void) function is called, they fail to correctly detect the end of the linked list and try to access a non-existent list member. This is related to init_aliases in diraliases.c.

Affected products

• Canonical Ubuntu Linux: version 16.04 only
• Debian Debian Linux: version 8.0 only
• Fedoraproject Extra Packages For Enterprise Linux: version 7.0 only; version 8.0 only
• Fedoraproject Fedora: version 30 only; version 31 only; version 32 only
• Pureftpd Pure-Ftpd: before 1.0.50 (fixed in 1.0.50)

Published 2020-02-26. Last modified 2026-06-17.