CVE-2020-9273: a use-after-free in ProFTPd
A heap use-after-free in ProFTPd through 1.3.7rc2, turned into remote code execution by joining the FTP control and data channels — with the full write-up in Phrack 72.
CVE-2020-9273 is a heap use-after-free in ProFTPd, present through version 1.3.7rc2. It lives in the memory pool the server uses to build its command responses. If an FTP control connection is closed while a data transfer is still moving on its own connection, that response pool is freed — and then reused a moment later, when the server goes to write a response back to a client that is no longer there.