wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a "~{" argument to commands such as CWD, which is not properly handled by the glob function (ftpglob).

One-byte buffer overflow in replydirname function in BSD-based ftpd allows remote attackers to gain root privileges.