CVE-2016-3125

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman (DH) key to be used and consequently allow attackers to have unspecified impact via unknown vectors.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-254 CWE-310

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugs.proftpd.org/show_bug.cgi?id=4230Issue Tracking
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179109.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179143.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179905.html
http://lists.opensuse.org/opensuse-updates/2016-05/msg00080.html
http://lists.opensuse.org/opensuse-updates/2016-06/msg00045.htmlThird Party Advisory
http://proftpd.org/docs/NEWS-1.3.5bRelease Notes
http://proftpd.org/docs/NEWS-1.3.6rc2Release Notes
http://www.openwall.com/lists/oss-security/2016/03/11/14Mailing List
http://www.openwall.com/lists/oss-security/2016/03/11/3Mailing List
http://bugs.proftpd.org/show_bug.cgi?id=4230Issue Tracking
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179109.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179143.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179905.html
http://lists.opensuse.org/opensuse-updates/2016-05/msg00080.html
http://lists.opensuse.org/opensuse-updates/2016-06/msg00045.htmlThird Party Advisory
http://proftpd.org/docs/NEWS-1.3.5bRelease Notes
http://proftpd.org/docs/NEWS-1.3.6rc2Release Notes
http://www.openwall.com/lists/oss-security/2016/03/11/14Mailing List
http://www.openwall.com/lists/oss-security/2016/03/11/3Mailing List

Timeline

Published: Apr 5, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-31266.1Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote atta CVE-2016-31277.5An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlier than 2.3.53.62 allo CVE-2016-31288.2A spoofing vulnerability in the Core of BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to enroll an illegitima CVE-2016-31296.6A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server (GEMS) implementation of the Apache Karaf command s CVE-2016-31308.1An information disclosure vulnerability in the Core and Management Console in BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows re CVE-2016-31316.5Cloudera CDH before 5.6.1 allows authorization bypass via direct internal API calls.CVE-2016-31329.8Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attac CVE-2016-31348.4The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local users to gain privileg CVE-2016-31357.8Integer overflow in the xt_alloc_table_info function in net/netfilter/x_tables.c in the Linux kernel through 4.5.2 on 32-bit platforms allow CVE-2016-31364.6The mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c in the Linux kernel before 4.5.1 allows physically proximate attackers t CVE-2016-31374.6drivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL po CVE-2016-31384.6The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a deni