Your message dated Tue, 13 Oct 2026 05:33:57 +0000
with message-id <[email protected]>
and subject line Bug#1150240: fixed in lrzsz 0.13.1-1
has caused the Debian Bug report #1150240,
regarding lrzsz: CVE-2026-105840 CVE-2026-105841 CVE-2026-105842
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150240: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150240
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: lrzsz
Version: 0.12.21rc-5
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for lrzsz.
CVE-2026-105840[0]:
| lrzsz before 0.13.0 contains a path traversal vulnerability in the
| lrz receive utility's restricted mode that allows malicious ZMODEM
| senders to write files outside the current directory using absolute
| pathnames. Because checkpath() in src/lrz.c only rejects '../'
| sequences unless built with --enable-pubdir, attackers can send
| files named with absolute paths to overwrite any file writable by
| the receiving user.
CVE-2026-105841[1]:
| lrzsz before 0.13.0 contains an OS command injection vulnerability
| in the lrz receive utility's pipe mode that allows remote senders to
| execute commands by supplying crafted filenames. When lrz runs under
| a suffixed name such as lrztar, procheader() in src/lrz.c passes the
| unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters
| execute as the receiving user.
CVE-2026-105842[2]:
| lrzsz before 0.13.0 contains a heap-based buffer overflow
| vulnerability in procheader() of the lrz receive utility when
| copying overlong sender-supplied filenames into Pathname. Malicious
| ZMODEM senders can supply filenames up to 8192 bytes, overflowing
| the buffer via sprintf() in pipe mode or strcpy() to corrupt heap
| memory and crash lrz.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-105840
https://www.cve.org/CVERecord?id=CVE-2026-105840
[1] https://security-tracker.debian.org/tracker/CVE-2026-105841
https://www.cve.org/CVERecord?id=CVE-2026-105841
[2] https://security-tracker.debian.org/tracker/CVE-2026-105842
https://www.cve.org/CVERecord?id=CVE-2026-105842
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: lrzsz
Source-Version: 0.13.1-1
Done: Martin A. Godisch <[email protected]>
We believe that the bug you reported is fixed in the latest version of
lrzsz, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Martin A. Godisch <[email protected]> (supplier of updated lrzsz package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 13 Oct 2026 07:04:50 +0200
Source: lrzsz
Architecture: source
Version: 0.13.1-1
Distribution: unstable
Urgency: medium
Maintainer: Martin A. Godisch <[email protected]>
Changed-By: Martin A. Godisch <[email protected]>
Closes: 1150240
Changes:
lrzsz (0.13.1-1) unstable; urgency=medium
.
* New upstream release, fixes CVE-2026-105840, CVE-2026-105841 and
CVE-2026-105842, closes: #1150240.
* Added debian/NEWS about options and features removed upstream.
* Dropped almost all Debian patches that are now included upstream or no
longer apply to the new code base.
* Dropped DSZLOG support patch, see debian/NEWS.
* Updated 02-rz-terminate-received-strings.diff: enlarge the receive buffer
by one byte and clear it once after allocation, since a sender-supplied
name that fills the whole subpacket has no NUL of its own, and the
attribute parsing would otherwise start one byte past the buffer. Dropped
its PATH_MAX length check, which is no longer needed.
* Added lsz_manpage_default_typo.diff.
* Dropped stale README.cvs.
* Switched to debhelper compat level 14.
* Switched debian/rules to a minimal dh rules file.
* Dropped Priority and Rules-Requires-Root from debian/control.
* Updated build-dependencies for upstream quickcheck test suite.
* Converted debian/copyright to machine-readable format.
* Added debian/upstream/metadata.
* Updated watch file.
Checksums-Sha1:
7560385519be18a5b7e58947f7aed117068a72aa 1896 lrzsz_0.13.1-1.dsc
4fdefa37c39e6f41f9192924d119e1f8967f477f 483782 lrzsz_0.13.1.orig.tar.gz
38dad7103525887f9ce5cd1c2bc4b21f3f4d3455 10520 lrzsz_0.13.1-1.debian.tar.xz
e54902d2132d0dbf12d918cd760e605293d75bc7 5923 lrzsz_0.13.1-1_amd64.buildinfo
Checksums-Sha256:
101aa555a422751d190e20183e13d66573c6a7f2856f7c6ac07f7ddd47d5fd4e 1896
lrzsz_0.13.1-1.dsc
112f91059fbd118e016d800c1a5c5a1702e965d8b9bfbda6015e44e20bfb93c9 483782
lrzsz_0.13.1.orig.tar.gz
0cede4418e5c3a2a0043f74913564fa366812c7479764c33351db7e08d762a8f 10520
lrzsz_0.13.1-1.debian.tar.xz
a066eb8fd05901770904f69878d9b8f399f7ded060181c14de5ca066508875f6 5923
lrzsz_0.13.1-1_amd64.buildinfo
Files:
3b76bc5e19751cf639bc97207407142b 1896 comm optional lrzsz_0.13.1-1.dsc
5a4c4e4053512eb8a17bc2db73fec337 483782 comm optional lrzsz_0.13.1.orig.tar.gz
1799174e05de5c11e477b696229889d3 10520 comm optional
lrzsz_0.13.1-1.debian.tar.xz
98127ceded92770fadf90715f8389b04 5923 comm optional
lrzsz_0.13.1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJHBAEBCgAxFiEEGEIyO0/Pm5CZX6F/o1C5kfBaSFcFAmrNvL4THGdvZGlzY2hA
ZGViaWFuLm9yZwAKCRCjULmR8FpIV05LD/42Ie2FWm9RzOWqFsjdYz23xd0rAkSb
NGBVwgkr3GAEwhwg7umKbgEJjHQ1BC19IeIQxI9Ll6M+uZOp4HT060qA/QPRKtJx
AXCzyQm+HJXQAioWhLc+0EsC9NxtaO+PcwT7KaAytoZ9pHfSKX+R7IAp7sZqMiAS
6r8gNv/Rz+Y9KTeruAy+X8AM0wxDYEDvvcIza5enni1C0eUZpHk/C0hySpPvlswR
Xdi5YIz+sO5Qx46zOw3E8qpMte5w+gCptfeG/kM9MeF924icUyxnmIfhNtERHafj
dILuuaKWntbZYIW0Dk9z4asuCySi1rG7bRgLMsoLtd+Ug4BAsWsQ8jbY8SqIYKh7
fyuC+8JCUlFN3iwp06OqHGLZfHH12j0WNICKJMiswU5sJtd+S+OFzLr+GaQP1LiJ
5OO6/j3VQcRzgyB5hwcRQ4RvE63IkORmR2Fq6EBopnR3uxqfcXGrJWuGn7bCExhZ
v8Vf7B7ZAeHhy6WnkHGGXme/nzeNVU7aRWocIyllbV6K5wIR2FbPAOLUVNQAouc/
BTB52fKyd6CbyTZJHv2M+kQlM/BSQGmCuV0dD2B6nD/nydfojxumaL/j/75Na4vh
f7EOTYkrFuoECOvyWyPAdQTj3YV+tQuH4V5Bx6BaEVGQErOQcz2AbEiuQJy8RgcU
sPjy7/ulYxCiXw==
=cMWH
-----END PGP SIGNATURE-----
pgppAZKcw7Ikd.pgp
Description: PGP signature
--- End Message ---
