lrzsz security, bug fix, and enhancement update

An update is available for lrzsz. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem...

lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode

A flaw was found in lrzsz. When operating in pipe mode, the lrz receive utility does not properly sanitize file names received during file transfers before passing them to the system shell. A remote attacker can exploit this flaw by sending a specially crafted file name, leading to arbitrary...

lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode

A flaw was found in lrzsz. When operating in pipe mode, the lrz receive utility does not properly sanitize file names received during file transfers before passing them to the system shell. A remote attacker can exploit this flaw by sending a specially crafted file name, leading to arbitrary...

Rocky Linux 9 [CIQ] Security Update: lrzsz / lrzsz-debuginfo / lrzsz-debugsource Multiple Vulnerabilities (crlsa-2026_89755)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202689755 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via crafte...

lrzsz security, bug fix, and enhancement update

An update is available for lrzsz. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem...

MiracleLinux 9 : lrzsz-0.12.20-58.el9_8 (AXSA:2026-2168:02)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2168:02 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

RockyLinux 9 : lrzsz (RLSA-2026:89755)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:89755 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode

A flaw was found in lrzsz. When operating in pipe mode, the lrz receive utility does not properly sanitize file names received during file transfers before passing them to the system shell. A remote attacker can exploit this flaw by sending a specially crafted file name, leading to arbitrary...

Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...

ALSA-2026:89755 Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...

Important: lrzsz

Issue Overview: lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped...

lrzsz security, bug fix, and enhancement update

An update is available for lrzsz. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmode...

Rocky Linux 10.2 [CIQ] Security Update: lrzsz / lrzsz-debuginfo / lrzsz-debugsource Multiple Vulnerabilities (crlsa-2026_86056)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686056 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: lrzsz (UTSA-2026-142360)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142360 advisory. lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying...

AlmaLinux 10 : lrzsz (ALSA-2026:86056)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:86056 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

RockyLinux 10 : lrzsz (RLSA-2026:86056)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:86056 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

RHEL 10 : lrzsz (RHSA-2026:86056)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:86056 advisory. Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz...

lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode

A flaw was found in lrzsz. When operating in pipe mode, the lrz receive utility does not properly sanitize file names received during file transfers before passing them to the system shell. A remote attacker can exploit this flaw by sending a specially crafted file name, leading to arbitrary...

CLSA-2026-1792503867 lrzsz: Fix of 3 CVEs

CVE-2026-105840: reject absolute path names in restricted mode in lrz received files and lsz sent files, not only in PUBDIR builds - CVE-2026-105841: remove the pipe mode that ran received files through a shell command when lrz was invoked as rzCOMMAND - CVE-2026-105842: allocate the received...

ALSA-2026:86056 Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...