Bugs fixes in "rsync"
| Origin | Bug number | Title | Date fixed |
|---|---|---|---|
| CVE | CVE-2026-45232 | Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c th | 2026-05-20 |
| CVE | CVE-2026-43620 | Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rs | 2026-05-20 |
| CVE | CVE-2026-43619 | Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unli | 2026-05-20 |
| CVE | CVE-2026-43618 | Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked | 2026-05-20 |
| CVE | CVE-2026-43617 | Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when | 2026-05-20 |
| CVE | CVE-2026-41035 | In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim | 2026-05-20 |
| CVE | CVE-2025-10158 | A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array in | 2026-05-20 |
| CVE | CVE-2026-45232 | Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c th | 2026-05-20 |
| CVE | CVE-2026-43620 | Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rs | 2026-05-20 |
| CVE | CVE-2026-43619 | Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unli | 2026-05-20 |
| CVE | CVE-2026-43618 | Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked | 2026-05-20 |
| CVE | CVE-2026-43617 | Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when | 2026-05-20 |
| CVE | CVE-2026-41035 | In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim | 2026-05-20 |
| CVE | CVE-2025-10158 | A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array in | 2026-05-20 |
| CVE | CVE-2026-45232 | Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c th | 2026-05-20 |
| CVE | CVE-2026-43620 | Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rs | 2026-05-20 |
| CVE | CVE-2026-43619 | Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unli | 2026-05-20 |
| CVE | CVE-2026-43618 | Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked | 2026-05-20 |
| CVE | CVE-2026-43617 | Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when | 2026-05-20 |
| CVE | CVE-2026-41035 | In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim | 2026-05-20 |
About
-
Send Feedback to @ubuntu_updates
