Proftpd critical security leak hasn't been fixed on Ubuntu since May

Which illustrates the risk of running "universe" packages.