Description
Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support enabled, might allow remote attackers to execute arbitrary code via unknown vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rsync | 3.0.2-1 | — |
| Debian 13 | rsync | 3.0.2-1 | — |
| Debian 12 | rsync | 3.0.2-1 | — |
| Debian 4.0 | rsync | 2.6.9-2etch2 | DSA-1545-1 |
Advisories 1
- DSA-1545-1 rsync Debian Security (DSA / DLA) · Mar 9, 2026
References
- 29856 third-party-advisory
- 29788 third-party-advisory
- SUSE-SR:2008:011 vendor-advisory
- GLSA-200804-16 vendor-advisory
- [rsync-announce] 20080408 Rsync 3.0.2 released w/xattr security fix (attn: 2.6.9 onward) mailing-list
- USN-600-1 vendor-advisory
- 29781 third-party-advisory
- http://sourceforge.net/project/shownotes.php?release_id=591462&group_id=69227
- ADV-2008-1215 vdb-entry
- 29770 third-party-advisory
- FEDORA-2008-3047 vendor-advisory
- http://rsync.samba.org/ftp/rsync/security/rsync-3.0.1-xattr-alloc.diff
- http://samba.anu.edu.au/rsync/security.html#s3_0_2
- MDVSA-2008:084 vendor-advisory
- ADV-2008-1191 vdb-entry
- 28726 vdb-entry
- 1019835 vdb-entry
- 29861 third-party-advisory
- 29668 third-party-advisory
- DSA-1545 vendor-advisory
- HPSBMA02447 vendor-advisory
- FEDORA-2008-3060 vendor-advisory
- 29777 third-party-advisory
- rsync-xattr-bo(41766) vdb-entry
- 44369 vdb-entry
- 44368 vdb-entry