[Bug 1470259] Re: Critical security fix for CVE-2015-3306

[Tyler Hicks]

*** This bug is a duplicate of bug 1462311 ***
    https://bugs.launchpad.net/bugs/1462311

Hi Willem - proftpd-dfsg is in the universe pocket which means that it
is a community maintained package. Someone will need to step up and
create debdiffs containing the backported security fixes. The process is
outlined here:

https://wiki.ubuntu.com/SecurityTeam/SponsorsQueue#Notes_for_Contributors

-- 
You received this bug notification because you are a member of ProFTPD
Maintainance Team, which is subscribed to proftpd-dfsg in Ubuntu.
https://bugs.launchpad.net/bugs/1470259

Title:
  Critical security fix for CVE-2015-3306

Status in proftpd-dfsg package in Ubuntu:
  New

Bug description:
  Hi and thanks for maintaining proftpd. We're seeing active
  exploitation of CVE-2015-3306 on standard proftpd installs (Ubuntu
  12.04 and 14.04). Is there a particular reason there has not been a
  release yet? CVE details were released 2015-05-22.

  See also:

  http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-3306.html
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3306
  https://www.exploit-db.com/exploits/36742/
  http://bugs.proftpd.org/show_bug.cgi?id=4169

  Ciao,
  Willem

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/proftpd-dfsg/+bug/1470259/+subscriptions