CentOS Linux 6 [TuxCare] Security Update: rsync (CENTOS6:CLSA-2026:1791908277)

The CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1791908277 advisory. - Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename...

CLSA-2026-1792425300 rsync: Fix of CVE-2026-70461

CVE-2026-70461: heap out-of-bounds write in addimpliedinclude -- trailing backslash not counted when sizing the implied-include rule...

CLSA-2026-1792362285 rsync: Fix of 3 CVEs

CVE-2026-53792: reject a peer-supplied checksum header with a non-zero block count and a zero block length, so a malicious receiver can no longer drive the sender's block matching into an out-of-bounds read - CVE-2026-53796: resolve the non-daemon receiver's destination directory through the...

AlmaLinux 9.2 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792362285)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792362285 advisory. - rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious...

CentOS Linux 7 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791972286)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1791972286 advisory. - rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who c...

CLSA-2026-1791908277 rsync: Fix of CVE-2026-43619

CVE-2026-29518: re-implement the "use chroot = no" confinement after the centos7els fix: every path operation proves its parent directory beneath the pinned module root through /proc/self/fd and runs on it with the at calls. In-module symlinks, directories the daemon uid may search but not read,...

CLSA-2026-1792143084 rsync: Fix of CVE-2026-53785

CVE-2026-53785: create a transfer's implied parent directories and the generator's directory entries through the symlink-race-safe parent walk, so a symlink planted at a parent component cannot make a non-chrooted receiver create them outside the destination tree - CVE-2026-53783: complete the...

CLSA-2026-1792173472 rsync: Fix of CVE-2026-70460

CVE-2026-70460: confine a peer-supplied --partial-dir and --backup-dir on a daemon module to the module root, so an in-module symlink can no longer redirect partial-file or backup reads, writes, renames and unlinks outside the module...

CLSA-2026-1792143468 rsync: Fix of CVE-2026-53785

CVE-2026-53785: create a transfer's implied parent directories and the generator's directory entries through the symlink-race-safe parent walk, so a symlink planted at a parent component cannot make a non-chrooted receiver create them outside the destination tree - CVE-2026-53783: complete the...

Astra Linux – Vulnerability in rsync

In rsync versions 3.0.1 through 3.4.1, the receivexattr function relies on an untrusted length value during a qsort call, resulting in a use-after-free vulnerability. The vulnerability is exploitable when rsync is executed with the -X option also known as --xattrs. On Linux, many but not all comm...

Astra Linux – vulnerability in rsync

A flaw was found in rsync; it can be triggered when rsync compares file checksums. This flaw enables an attacker to manipulate the checksum length s2length to cause a comparison between a checksum and uninitialized memory, resulting in the gradual leakage of one byte of uninitialized stack data a...

Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in the IBM Netezza Appliance have been remediated in the latest security patch release of NPS Vulnerability Details CVEID:CVE-2023-36464 DESCRIPTION: pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads t...

CLSA-2026-1791972286 rsync: Fix of 3 CVEs

CVE-2026-53801: extend the fix to the sender outside a daemon: prevent it from listing a directory outside the transfer through a path component swapped for a symlink - CVE-2026-53797: prevent the sender from reading a file outside the transfer the same way - CVE-2026-53800: prevent...

CLSA-2026-1791972230 rsync: Fix of 3 CVEs

CVE-2026-53801: extend the fix to the sender outside a daemon: prevent it from listing a directory outside the transfer through a path component swapped for a symlink - CVE-2026-53797: prevent the sender from reading a file outside the transfer the same way - CVE-2026-53800: prevent...

CLSA-2026-1791972141 rsync: Fix of 3 CVEs

CVE-2026-53801: extend the fix to the sender outside a daemon: prevent it from listing a directory outside the transfer through a path component swapped for a symlink - CVE-2026-53797: prevent the sender from reading a file outside the transfer the same way - CVE-2026-53800: prevent...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-4046 DESCRIPTION: The iconv function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130136)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130136 advisory. rsync before 3.5.0contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130072)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130072 advisory. rsync before 3.5.0contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130120)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130120 advisory. rsync before 3.5.0contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130076)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130076 advisory. rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink...