Source: lrzsz Version: 0.12.21rc-5 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for lrzsz. CVE-2026-105840[0]: | lrzsz before 0.13.0 contains a path traversal vulnerability in the | lrz receive utility's restricted mode that allows malicious ZMODEM | senders to write files outside the current directory using absolute | pathnames. Because checkpath() in src/lrz.c only rejects '../' | sequences unless built with --enable-pubdir, attackers can send | files named with absolute paths to overwrite any file writable by | the receiving user. CVE-2026-105841[1]: | lrzsz before 0.13.0 contains an OS command injection vulnerability | in the lrz receive utility's pipe mode that allows remote senders to | execute commands by supplying crafted filenames. When lrz runs under | a suffixed name such as lrztar, procheader() in src/lrz.c passes the | unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters | execute as the receiving user. CVE-2026-105842[2]: | lrzsz before 0.13.0 contains a heap-based buffer overflow | vulnerability in procheader() of the lrz receive utility when | copying overlong sender-supplied filenames into Pathname. Malicious | ZMODEM senders can supply filenames up to 8192 bytes, overflowing | the buffer via sprintf() in pipe mode or strcpy() to corrupt heap | memory and crash lrz. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-105840 https://www.cve.org/CVERecord?id=CVE-2026-105840 [1] https://security-tracker.debian.org/tracker/CVE-2026-105841 https://www.cve.org/CVERecord?id=CVE-2026-105841 [2] https://security-tracker.debian.org/tracker/CVE-2026-105842 https://www.cve.org/CVERecord?id=CVE-2026-105842 Regards, Salvatore
