Two buffer overflows exist in lftp versions 2.3 to 2.6.9. When using the ls and rels commands during an HTTP/HTTPS connection, an attacker has the opportunity to exploit a sscanf() call in try_netscape_proxy() and try_squid_eplf().
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/32382/lftpadv.tgz
Source: https://packetstormsecurity.com/files/32382/lftpadv.tgz.html