rsync bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

macOS 10.15.x < 10.15.6 / 10.14.x < 10.14.6 Security Update 2020-004 / 10.13.x < 10.13.6 Security Update 2020-004

The remote host is running a version of macOS / Mac OS X that is 10.13.x prior to 10.13.6 Security Update 2020-004, 10.14.x prior to 10.14.6 Security Update 2020-004, or 10.15.x prior to 10.15.6. It is, therefore, affected by multiple vulnerabilities, including the following: - A vulnerability wa...

NICER Protocol Deep Dive: Internet Exposure of rsync

Welcome to the NICER Protocol Deep Dive blog series! When we started researching what all was out on the internet way back in January, we had no idea we'd end up with a hefty, 137-page tome of a research report. The sheer length of such a thing might put off folks who might otherwise learn a thin...

CVE-2020-14387

A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise...

Western Digital My Cloud Multiple Products < 2.12.127 / 2.20 - 2.30 < 2.31.149 Multiple Vulnerabilities

Multiple Western Digital My Cloud products are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-firefox-68.12.0esr-i686-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more...

FreeBSD : net/rsync -- multiple zlib issues (085399ab-dfd7-11ea-96e4-80ee73bc7b66)

rsync developers reports : Various zlib fixes, including security fixes for CVE-2016-9843, CVE-2016-9842, CVE-2016-9841, and CVE-2016-9840 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020...

GLSA-202007-54 : rsync: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202007-54 rsync: Multiple vulnerabilities Multiple vulnerabilities have been discovered in rsync within bundled zlib. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE...

rsync: Multiple vulnerabilities

Background File transfer program to keep remote files into sync. Description Multiple vulnerabilities have been discovered in rsync within bundled zlib. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround Ther...

[slackware-security] libjpeg-turbo

New libjpeg-turbo packages are available for Slackware 14.2 and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/libjpeg-turbo-2.0.5-i586-1slack14.2.txz: Upgraded. This update fixes bugs and a security issue: Fixed an issue in the PPM read...

net/rsync -- multiple zlib issues

rsync developers reports: Various zlib fixes, including security fixes for CVE-2016-9843, CVE-2016-9842, CVE-2016-9841, and CVE-2016-9840...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-thunderbird-68.9.0-i686-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-firefox-68.9.0esr-i686-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more...

rsync

WHAT IS RSYNC? -------------- Rsync is a fast and extraordinari...

[slackware-security] libexif

New libexif packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/libexif-0.6.22-i486-1slack14.2.txz: Upgraded. This update fixes bugs and security issues: CVE-2018-20030: Fix for...

OS Command Injection

rsync is vulnerable to OS command injeciton. It does not validate the user-provided /bin/sh command inside the spawn function and directly executes with executableShell, leading to a remote code execution RCE...

Arbitrary Code Execution

rsync is vulnerable to arbitrary code execution. The vulnerability exists as the receivexattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service heap-based buffer...

Access Control Bypass

rsync is vulnerable to access control bypass. The parsearguments function in options.c does not prevent multiple --protect-args uses and allows remote attackers to bypass the argument-sanitization protection mechanism...

Access Control Bypass

rsync is vulnerable to access control bypass. The recvfiles function in receiver.c does not check for a filename in the daemonfilterlist data structure, allowing remote attackers to bypass intended access restrictions...

Access Control Bypass

rsync is vulnerable to access control bypass. A remote attacker is able to bypass access restrictions as the daemon does not check for fnamecmp filenames in the daemonfilterlist data structure in recvfiles function in receiver.c. The sanitizepaths protection mechanism is also not applied to...