62 results · Feed
-
Low 3.1
Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy
Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can …
-
High 7.4
In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a recei…
-
Medium 4.3
Rsync: Out of bounds array access via negative index
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger t…
-
Critical 9.8
Rsync: heap buffer overflow in rsync due to improper checksum length handling
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of b…
-
Medium 6.5
Rsync: path traversal vulnerability in rsync
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--i…
-
Medium 5.6
Rsync: race condition in rsync handling symbolic links
A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the…
-
Medium 6.5
Rsync: --safe-links option bypass leads to path traversal
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may …
-
Medium 6.1
Rsync: rsync server leaks arbitrary client files
A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of …
-
High 7.5CVE-2024-12085 Public exploit
Rsync: info leak via uninitialized stack contents
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitializ…
-
Critical 9.8
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip heade…
-
Unscored —CVE-2022-29154 Public exploit
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the …
-
High 7.5
Nokogiri affected by zlib's Out-of-bounds Write vulnerability
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
-
Unscored —CVE-2018-5764 Public exploit
The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses…
-
Unscored —
The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds w…
-
Unscored —
The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon…
-
Unscored —
The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' characte…
-
Unscored —
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via …
-
High 8.8
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact …
-
Unscored —
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper poin…
-
Unscored —
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper point…
-
Unscored —
rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization p…
-
Unscored —
The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of ser…