{"id":"CVE-2024-48208","aliases":["DEBIAN-CVE-2024-48208","EUVD-2024-42955","GHSA-rrmj-qxgv-v296","UBUNTU-CVE-2024-48208","openSUSE-SU-2025:15266-1"],"status":"published","title":"pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the...","description":"pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.01562,"percentile":0.75464,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-125"],"published":"2024-10-24T00:00:00Z","modified":"2026-11-02T12:02:52Z","exploits":[{"source":"nuclei","id":"CVE-2024-48208","title":"Pure-FTPd \u003c 1.0.52 - Buffer Overflow","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2024/CVE-2024-48208.yaml"},{"source":"pocgithub","id":"rohilchaudhry/CVE-2024-48208","title":"rohilchaudhry/CVE-2024-48208","date":"2024-10-30","url":"https://github.com/rohilchaudhry/CVE-2024-48208"}],"fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"pure-ftpd","fixed_in":["1.0.51-5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"pure-ftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.50-2.1","1.0.50-2.2","1.0.50-2.3"]},{"source":"osv","ecosystem":"Debian:13","package":"pure-ftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.50-2.2","1.0.50-2.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"pure-ftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.36-3.2","1.0.36-3.2build1","1.0.36-3.2+deb8u1build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pure-ftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.46-1","1.0.46-1build1","1.0.46-1ubuntu18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pure-ftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.47-3build1","1.0.49-1","1.0.49-2","1.0.49-3","1.0.49-4","1.0.49-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pure-ftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.49-4.1build1","1.0.50-2","1.0.50-2.1","1.0.50-2.1ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pure-ftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.50-2.1build1","1.0.50-2.1ubuntu1","1.0.50-2.2","1.0.50-2.2build1","1.0.50-2.2build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"pure-ftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.50-2.2build3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pure-ftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.50-2.2build3","1.0.50-2.2build4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pure-ftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.51-5.1"}]}]}],"products":[{"vendor":"pureftpd","product":"pure-ftpd"}],"references":[{"url":"https://github.com/jedisct1/pure-ftpd/pull/176","tags":["Exploit","Issue Tracking","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48208","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rrmj-qxgv-v296"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48208.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-48208","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-48208","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-48208","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48208","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-48208","description":"pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.","status":"published","published":"2024-10-24T00:00:00Z","modified":"2024-10-28T18:27:39.239Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:34:11.638716Z"}],"euvd":[{"id":"EUVD-2024-42955","description":"pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.","status":"published","published":"2024-10-24T00:00:00Z","modified":"2024-10-28T18:27:39Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-03T00:05:16.135425Z"}],"ghsa":[{"id":"GHSA-rrmj-qxgv-v296","title":"pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the...","description":"pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.","status":"published","published":"2024-10-24T21:31:04Z","modified":"2024-10-28T21:31:38Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:58:38.070803Z"}],"nvd":[{"id":"CVE-2024-48208","description":"pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.","status":"published","published":"2024-10-24T21:15:14.04Z","modified":"2026-06-17T07:58:17.477Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:10:34.877798Z"}],"osv":[{"id":"CVE-2024-48208","description":"pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.","status":"published","published":"2024-10-24T00:00:00Z","modified":"2026-10-28T02:30:31.213773687Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:43.253252Z"},{"id":"DEBIAN-CVE-2024-48208","description":"pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.","status":"published","published":"2024-10-24T21:15:14.04Z","modified":"2026-11-02T12:02:52.698338752Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.798789Z"},{"id":"UBUNTU-CVE-2024-48208","description":"pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.","status":"published","published":"2024-10-24T21:15:00Z","modified":"2026-05-20T16:18:56.569362607Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:06.818511Z"},{"id":"openSUSE-SU-2025:15266-1","title":"pure-ftpd-1.0.51-5.1 on GA media","description":"These are all security issues fixed in the pure-ftpd-1.0.51-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:34.37514Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}