Skip to content
OpenAdvisories
Medium ELSA-2026-6825 1 CVE

Moderate: rsync security update (Oracle Linux 10)

Published Apr 7, 2026 · Updated Apr 7, 2026

Ecosystem: Oracle Linux

Summary

[3.4.1-2.2]
- Resolves: RHEL-152885 - CVE-2025-10158 Out of bounds array access via negative index

[3.4.1-2.1]
- Resolves: RHEL-152878 - clearing DISPLAY breaks SSH_ASKPASS expectations

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 10 rsync 0:3.4.1-2.el10_1.2
Oracle Linux · 10 rsync-daemon 0:3.4.1-2.el10_1.2
Oracle Linux · 10 rsync-rrsync 0:3.4.1-2.el10_1.2

Vulnerabilities 1

  • Medium 4.3
    CVE-2025-10158

    Rsync: Out of bounds array access via negative index

    A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger t…

    rsync rsync rsync rsync Debian Ubuntu Azure Linux Alpine