CVE-2011-4130
Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote...
CVE-2011-4130 is a high vulnerability (CVSS 9.0) in Proftpd, published November 15, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.6%, the 96th percentile. Fixed in proftpd-dfsg 1.3.4~rc3-2.
- Severity
- 9.0 HighCVSS 2.0, NVD
- Exploit chance
- 12.6%EPSS, 96th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.3.4~rc3-2proftpd-dfsg +6 more
Description
Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
proftpd-dfsgDebian:12 | before 1.3.4~rc3-2 | 1.3.4~rc3-2 |
proftpd-dfsgDebian:13 | before 1.3.4~rc3-2 | 1.3.4~rc3-2 |
proftpd-dfsgDebian:14 | before 1.3.4~rc3-2 | 1.3.4~rc3-2 |
proftpd-dfsgDebian:5.0 | before 1.3.1-17lenny8, plus listed versions 1.3.1-161.3.1-171.3.1-17lenny11.3.1-17lenny21.3.1-17lenny2~bpo40+1 Show 4 moreShow less1.3.1-17lenny31.3.1-17lenny41.3.1-17lenny4~bpo40+11.3.1-17lenny6 | 1.3.1-17lenny8 |
proftpd-dfsgDebian:6.0 | before 1.3.3a-6squeeze4, plus listed versions 1.3.3a-61.3.3a-6squeeze1 | 1.3.3a-6squeeze4 |
proftpd-dfsgDebian:5.0 | before 1.3.1-17lenny9, plus listed versions 1.3.1-161.3.1-171.3.1-17lenny11.3.1-17lenny21.3.1-17lenny2~bpo40+1 Show 5 moreShow less1.3.1-17lenny31.3.1-17lenny41.3.1-17lenny4~bpo40+11.3.1-17lenny61.3.1-17lenny8 | 1.3.1-17lenny9 |
proftpdopenSUSE:Tumbleweed From an advisory covering 8 CVEs | before 1.3.5b-2.5 | 1.3.5b-2.5 |
What each source reports
NVD Score used
Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.
- Record
CVE-2011-4130- CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE ListNo score
Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.
- Record
CVE-2011-4130- Updated
- 2026-11-02
EUVDEUVD-2011-4078No score
Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.
- Record
EUVD-2011-4078- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jmgj-wg56-hjr9No score
Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote...
Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.
- Record
GHSA-jmgj-wg56-hjr9- Updated
- 2026-11-02
OSVNo score
Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.
- Record
CVE-2011-4130- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-4130No score
Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.
- Record
DEBIAN-CVE-2011-4130- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10048-1No score
proftpd-1.3.5b-2.5 on GA media
These are all security issues fixed in the proftpd-1.3.5b-2.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10048-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
bugs.proftpd.org/show_bug.cgi?id=3711
zerodayinitiative.com/advisories/ZDI-11-328
proftpd.org/docs/NEWS-1.3.3g
securityfocus.com/bid/50631
nvd.nist.gov/vuln/detail/CVE-2011-4130
github.com/advisories/GHSA-jmgj-wg56-hjr9
Show 9 moreShow less
security-tracker.debian.org/tracker/CVE-2011-4130
suse.com/security/cve/CVE-2009-0542