SUSE-SU-2026:5181-1: Security update for proftpd

This update for proftpd fixes the following issues:

- Authenticated SFTP sessions can overflow the SFTP packet buffer (bsc#1271096). - CVE-2026-35025: access control bypass allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler (bsc#1269065). - CVE-2026-42167: modsql allows remote attackers to execute arbitrary code via a username when there is logging of USER requests with an expansion such as %U and the SQL backend allows comman (bsc#1263183). - CVE-2026-44331: SQL injection in sqltabfetchclientscb() in contrib/modwrap2sql.c triggered via crafted domain name from reverse DNS lookup (bsc#1264262). - CVE-2026-53994: heap-based buffer overflow reachable by an authenticated SFTP user can lead to denial of service and memory corruption (bsc#1271946). - CVE-2026-63090: heap-based buffer overflow in the modsftp module can lead to arbitrary code execution via crafted SFTP packet fragments (bsc#1271944). - CVE-2026-63091: signed integer overflow in the modsftp module's SCP size-record parser can lead to ASLR bypass via a crafted file size value of UINT64MAX (bsc#1271945). - CVE-2026-119147: authorization bypass in the modsftp copy-file extension handler allows SFTP users to copy any readable file to a new path in write-denied directories (bsc#1289272). - Integer overflow via client-provided file size for SCP uploads (bsc#1271097).