SUSE-SU-2026:5156-1: Security update for vsftpd

Q: What access would an attacker need to trigger the denial of service?

The issue is triggered through parsing parameters to the FTP ls command, so the attacker would need to be able to send that command to a vulnerable vsftpd service. The provided data does not specify whether authentication is required.

Q: Which systems are identified as affected by this update?

The update applies to vsftpd on SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security for x86_64. Associated vsftpd debugsource and debuginfo packages are also listed.

Q: What is the impact of successful exploitation?

Successful exploitation can cause a denial of service through an integer overflow while parsing ls command parameters. No confidentiality or privilege-escalation impact is described in the provided data.

Published Nov 10, 2026

Updated

This update for vsftpd fixes the following issue:

- CVE-2025-14242: denial of service via integer overflow in ls command parameter parsing (bsc#1256700).

Other sources

This update for vsftpd fixes the following issue: CVE-2025-14242: denial of service via integer overflow in ls command parameter parsing (bsc#1256700).

— SUSE

Affected Software

5 affected componentsFixes available

suse/vsftpd<3.0.5-60.1

3.0.5-60.1

All of the following

SUSE SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64)

Any of the following

suse/vsftpd<3.0.5-60.1

3.0.5-60.1

suse/vsftpd-debugsource<3.0.5-60.1

3.0.5-60.1

suse/vsftpd-debuginfo<3.0.5-60.1

3.0.5-60.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/vsftpd to a version that resolves this vulnerability.
Fixed in 3.0.5-60.1
Upgrade
Upgrade suse/vsftpd-debugsource to a version that resolves this vulnerability.
Fixed in 3.0.5-60.1
Upgrade
Upgrade suse/vsftpd-debuginfo to a version that resolves this vulnerability.
Fixed in 3.0.5-60.1
Upgrade
Upgrade vsftpd to a version that resolves this vulnerability.
Patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-5156

Event History

Nov 10, 2026

Advisory Published

via OSV·09:31 AM

Data Sourced

via OSV·09:31 AM

DescriptionAffected Software

Data Sourced

via SUSE·09:31 AM

RemedyDescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2025-14242

Frequently Asked Questions

What access would an attacker need to trigger the denial of service?

The issue is triggered through parsing parameters to the FTP ls command, so the attacker would need to be able to send that command to a vulnerable vsftpd service. The provided data does not specify whether authentication is required.

Which systems are identified as affected by this update?

The update applies to vsftpd on SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security for x86_64. Associated vsftpd debugsource and debuginfo packages are also listed.

What is the impact of successful exploitation?

Successful exploitation can cause a denial of service through an integer overflow while parsing ls command parameters. No confidentiality or privilege-escalation impact is described in the provided data.

SUSE-SU-2026:5156-1: Security update for vsftpd

Other sources

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access would an attacker need to trigger the denial of service?

Which systems are identified as affected by this update?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What access would an attacker need to trigger the denial of service?

Which systems are identified as affected by this update?

What is the impact of successful exploitation?