UbuntuUpdates.org

Package "rsync"

Name: rsync

Description:

fast, versatile, remote (and local) file-copying tool
Latest version: 3.4.1+ds1-7ubuntu0.2
Release: resolute (26.04)
Level: security
Repository: main
Homepage: https://rsync.samba.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "rsync"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "rsync" in Resolute

Repository Area Version
base main 3.4.1+ds1-7
updates main 3.4.1+ds1-7ubuntu0.2

Changelog

Version: 3.4.1+ds1-7ubuntu0.2 2026-05-20 14:07:38 UTC

  rsync (3.4.1+ds1-7ubuntu0.2) resolute-security; urgency=medium

  * SECURITY UPDATE: May 2026 security issues
    - debian/patches/security-202605/*.patch: commits to backport security
      fixes to 3.4.1.
    - d/p/CVE-2025-10158.patch: removed, included in patch cluster.
    - d/p/gcc_15.patch: removed, included in patch cluster.
    - d/p/fix-flaky-hardlinks-test.patch: removed, included in patch
      cluster.
    - CVE-2026-29518
    - CVE-2026-41035
    - CVE-2026-43617
    - CVE-2026-43618
    - CVE-2026-43619
    - CVE-2026-43620
    - CVE-2026-45232

 -- Marc Deslauriers <email address hidden> Thu, 14 May 2026 10:54:05 +0200
CVE-2025-10158 A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array in
CVE-2026-41035 In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim
CVE-2026-43617 Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when
CVE-2026-43618 Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked
CVE-2026-43619 Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unli
CVE-2026-43620 Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rs
CVE-2026-45232 Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c th


About   -   Send Feedback to @ubuntu_updates