rpm package
opensuse/rsync&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/rsync&distro=openSUSE%20Leap%2016.0
Vulnerabilities (41)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-70464 | Hig | 7.5 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open man | |
| CVE-2026-70463 | Hig | 8.1 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The s | |
| CVE-2026-70462 | Med | 6.5 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft m | |
| CVE-2026-70461 | Hig | 8.2 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against | |
| CVE-2026-70460 | Hig | 8.1 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the | |
| CVE-2026-70459 | Med | 5.3 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list en | |
| CVE-2026-70458 | Hig | 8.2 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing | |
| CVE-2026-70457 | Med | 6.5 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number | |
| CVE-2026-70456 | Hig | 8.2 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailin | |
| CVE-2026-70455 | Hig | 7.5 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can | |
| CVE-2026-70454 | Hig | 8.0 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit | |
| CVE-2026-70453 | Hig | 7.5 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookup | |
| CVE-2026-70452 | Hig | 7.4 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the da | |
| CVE-2026-53803 | Hig | 7.8 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failu | |
| CVE-2026-53802 | Hig | 7.1 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attack | |
| CVE-2026-53801 | Med | 5.9 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a p | |
| CVE-2026-53800 | Med | 4.7 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion | |
| CVE-2026-53799 | Med | 6.3 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent a | |
| CVE-2026-53798 | Med | 5.3 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subp | |
| CVE-2026-53797 | Med | 4.7 | < 3.4.1-160000.6.1 | 3.4.1-160000.6.1 | Aug 13, 2026 | rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent director |
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open man
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The s
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft m
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list en
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailin
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookup
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the da
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failu
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attack
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a p
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent a
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subp
- affected < 3.4.1-160000.6.1fixed 3.4.1-160000.6.1
rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent director
Page 1 of 3