[ GLSA 201706-09 ] FileZilla

[GLSA]

Gentoo Linux Security Advisory

Title: FileZilla: Buffer overflow (GLSA 201706-09)
Severity: normal
Exploitable: remote
Date: 2017-06-06
Bug(s): #610554
ID: 201706-09

Synopsis

A vulnerability in a bundled copy of PuTTY in FileZilla might allow
remote attackers to execute arbitrary code or cause a denial of service.


Background

FileZilla is an open source FTP client.

Affected Packages

Package: net-ftp/filezilla
Vulnerable: < 3.25.2
Unaffected: >= 3.25.2
Architectures: All supported architectures


Description

FileZilla is affected by the same vulnerability as reported in “GLSA
201703-03” because the package included a vulnerable copy of PuTTY.
Please read the GLSA for PuTTY referenced below for details.


Impact

A remote attacker, utilizing the SSH agent forwarding of an SSH server,
could execute arbitrary code with the privileges of the user running
FileZilla or cause a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All FileZilla users should upgrade to the latest version: