Summary
It was discovered that rsync incorrectly handled certain data input.
An attacker could possibly use this to cause a denial of service or
execute arbitrary code. (CVE-2017-16548)
It was discovered that rsync incorrectly parsed certain arguments. An attacker
could possibly use this to bypass arguments and execute arbitrary code.
(CVE-2018-5764)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | rsync | 3.1.0-2ubuntu0.4 |
| Ubuntu · 16.04 LTS 16.04:LTS | rsync | 3.1.1-3ubuntu1.2 |
Vulnerabilities 2
-
Unscored —
The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' characte…
-
Unscored —CVE-2018-5764 Public exploit
The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses…