SUSE-SU-2026:5155-1: Security update for vsftpd

Q: What attacker access is required to trigger the denial of service?

The issue is in parsing parameters for the FTP ls command, so exploitation requires the ability to send that command to a vulnerable vsftpd service. The provided advisory does not state whether authentication is required.

Q: Which systems are covered by this update?

The update covers vsftpd on openSUSE Leap 15.6 for aarch64, i586, ppc64le, s390x, and x86_64, and on SUSE Server Applications Module 15-SP7 for aarch64, ppc64le, s390x, and x86_64. Debugsource and debuginfo packages are also listed.

Q: What is the impact of successful exploitation?

The stated impact is denial of service caused by an integer overflow while parsing ls command parameters. The provided information does not describe data disclosure, privilege escalation, or code execution.

Published Nov 10, 2026

Updated

This update for vsftpd fixes the following issue:

- CVE-2025-14242: denial of service via integer overflow in ls command parameter parsing (bsc#1256700).

Other sources

This update for vsftpd fixes the following issue: CVE-2025-14242: denial of service via integer overflow in ls command parameter parsing (bsc#1256700).

— SUSE

Affected Software

9 affected componentsFixes available

suse/vsftpd<3.0.5-150600.10.9.1

3.0.5-150600.10.9.1

All of the following

SUSE openSUSE Leap 15.6 (aarch64 i586 ppc64le s390x x86_64)

Any of the following

suse/vsftpd-debugsource<3.0.5-150600.10.9.1

3.0.5-150600.10.9.1

suse/vsftpd-debuginfo<3.0.5-150600.10.9.1

3.0.5-150600.10.9.1

suse/vsftpd<3.0.5-150600.10.9.1

3.0.5-150600.10.9.1

All of the following

SUSE Server Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/vsftpd-debugsource<3.0.5-150600.10.9.1

3.0.5-150600.10.9.1

suse/vsftpd-debuginfo<3.0.5-150600.10.9.1

3.0.5-150600.10.9.1

suse/vsftpd<3.0.5-150600.10.9.1

3.0.5-150600.10.9.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/vsftpd to a version that resolves this vulnerability.
Fixed in 3.0.5-150600.10.9.1
Upgrade
Upgrade suse/vsftpd-debugsource to a version that resolves this vulnerability.
Fixed in 3.0.5-150600.10.9.1
Upgrade
Upgrade suse/vsftpd-debuginfo to a version that resolves this vulnerability.
Fixed in 3.0.5-150600.10.9.1
Upgrade
Upgrade vsftpd to a version that resolves this vulnerability.
Patch SUSE-2026-5155

Event History

Nov 10, 2026

Advisory Published

via OSV·09:31 AM

Data Sourced

via OSV·09:31 AM

DescriptionAffected Software

Advisory Published

via SUSE·09:31 AM

Data Sourced

via SUSE·09:31 AM

RemedyDescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2025-14242

Frequently Asked Questions

What attacker access is required to trigger the denial of service?

The issue is in parsing parameters for the FTP ls command, so exploitation requires the ability to send that command to a vulnerable vsftpd service. The provided advisory does not state whether authentication is required.

Which systems are covered by this update?

The update covers vsftpd on openSUSE Leap 15.6 for aarch64, i586, ppc64le, s390x, and x86_64, and on SUSE Server Applications Module 15-SP7 for aarch64, ppc64le, s390x, and x86_64. Debugsource and debuginfo packages are also listed.

What is the impact of successful exploitation?

The stated impact is denial of service caused by an integer overflow while parsing ls command parameters. The provided information does not describe data disclosure, privilege escalation, or code execution.

SUSE-SU-2026:5155-1: Security update for vsftpd

Other sources

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What attacker access is required to trigger the denial of service?

Which systems are covered by this update?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What attacker access is required to trigger the denial of service?

Which systems are covered by this update?

What is the impact of successful exploitation?