CVE Vulnerability Catalog

rsync versions 3.2.5 before 3.5.0 contain a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containing both an interior and trailing backslash, causing the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer.

rsync versions 2.3.3 before 3.5.0 contain a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent.

rsync versions 3.0.0 through before 3.5.0 contain a null pointer dereference vulnerability in the daemon child process. A remote attacker can send a file list whose first entry is a dot entry not typed as a directory, causing an invalid pointer dereference that terminates the client connection.

rsync versions 3.0.0 before 3.5.0 contain an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data.

rsync version 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. This can corrupt .bss memory.

rsync versions 3.0.1 before 3.5.0 contain an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory.

rsync versions 3.4.2 before 3.5.0 contain a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

rsync versions 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to validate server TLS certificates against a trusted CA or verify certificate hostname matching to decrypt or tamper with rsync session content without detection by the client.

Rsync before version 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service.

rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.

A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges.

In the Linux kernel, in the KVM subsystem for s390 PCI handling, a bug was found: when a guest registers IRQs without a summary bit, the associated GAITE entry stores an incorrect value (physical address instead of zero) in the guest AISB location. The fix ensures zero is stored there.

In the Linux kernel, in the s390/zcrypt subsystem, a buffer over-read vulnerability was found in cca_cipher2protkey. User-controlled length fields in CCA token structures were used without proper validation against buffer size and minimum token size, potentially leading to out-of-bounds reads or buffer underruns, causing kernel crashes or memory exposure.

In the Linux kernel, in the s390/zcrypt subsystem, a missing length validation was found in CCA AES cipher key requests. cca_cipher2protkey() derives the copy length from the key token length field, which could lead to out-of-bounds read if the token length exceeds the available space in the CPRB parameter block.

In the Linux kernel, in the s390/zcrypt subsystem, a missing length validation was found in CCA ECC private key requests. cca_ecc2protkey() derives the copy length from the key token length field, which could lead to out-of-bounds read if the token length exceeds the available space in the CPRB parameter block.

Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive information.

Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below.

An unencrypted 'pause encryption request' message causes a denial of service in the BT122 module. See vulnerability B-E10 in the related paper below.

A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below.