Description
Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rsync | 2.5.6-1.1 | — |
| Debian 13 | rsync | 2.5.6-1.1 | — |
| Debian 12 | rsync | 2.5.6-1.1 | — |
| Debian 3.0 | rsync | 2.5.5-0.2 | DSA-404 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rsync | 2.5.7-1 | RHSA-2003:399 |
Advisories 2
- RHSA-2003:399 Red Hat Security Advisory: rsync security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-404 rsync - heap overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20031204 rsync security advisory (fwd) mailing-list
- 2003-0048 vendor-advisory
- 10362 third-party-advisory
- 10364 third-party-advisory
- 10354 third-party-advisory
- linux-rsync-heap-overflow(13899) vdb-entry
- 10363 third-party-advisory
- 10353 third-party-advisory
- 10357 third-party-advisory
- 10355 third-party-advisory
- VU#325603 third-party-advisory
- 10358 third-party-advisory
- 20031204 GLSA: exploitable heap overflow in rsync (200312-03) mailing-list
- 10360 third-party-advisory
- 10361 third-party-advisory
- CLA-2003:794 vendor-advisory
- 20031204 [OpenPKG-SA-2003.051] OpenPKG Security Advisory (rsync) mailing-list
- 10474 third-party-advisory
- oval:org.mitre.oval:def:9415 vdb-entry signature
- RHSA-2003:398 vendor-advisory
- 10356 third-party-advisory
- 2898 vdb-entry
- MDKSA-2003:111 vendor-advisory
- 9153 vdb-entry
- 10359 third-party-advisory
- 10378 third-party-advisory