Total vulnerabilities in the database
The administration web interface in NetWin SurgeFTP 2.3a2 and earlier allows remote attackers to cause a denial of service (daemon crash) via a large integer in the Content-Length HTTP header, which triggers a NULL pointer dereference when memory allocation fails.
| Software | From | Fixed in |
|---|---|---|
| netwin / surgeftp | 2.3a2 | 2.3a2.x |