Off-by-one error in certain versions of xfstt allows remote attackers to read potentially sensitive memory via a malformed client request in the connection handshake, which leaks the memory in the server's response.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2003-0619
http://www.securityfocus.com/bid/8255
http://www.debian.org/security/2003/dsa-360