Most recent entries from all

ALSA-2025:2600 — Moderate: rsync security update

Affected: AlmaLinux:8: rsync, AlmaLinux:8: rsync-daemon

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

* rsync: Path traversal vulnerability in rsync (CVE-2024-12087) * rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088) * rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-00377

BELL-CVE-2024-12087

Affected: Alpaquita:23: rsync, Alpaquita:stream: rsync

certfr-2025-avi-0067 — De multiples vulnérabilités ont été découvertes dans Qnap HBS 3 Hybrid Backup Sync. Elles permettent à un attaquant de…

certfr-2025-avi-0067

EUVD-2026-331240

fkie_cve-2024-12087

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.

GHSA-9x68-7qq6-v523

msrc_CVE-2024-12087 — Rsync: path traversal vulnerability in rsync

msrc_CVE-2024-12087

OESA-2025-1060 — rsync security update

Affected: openEuler:22.03-LTS-SP4: rsync

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand. Security Fix(es): (CVE-2024-12085) (CVE-2024-12086) (CVE-2024-12087) (CVE-2024-12088) (CVE-2024-12747)

openSUSE-SU-2025:14665-1 — rsync-3.4.1-1.1 on GA media

rsync-3.4.1-1.1 on GA media

RHSA-2025:23154 — Red Hat Security Advisory: rsync security update

rsync: Path traversal vulnerability in rsync

SUSE-SU-2025:0156-1 — Security update for rsync

Security update for rsync

UBUNTU-CVE-2024-12087

Affected: Ubuntu:Pro:14.04:LTS: rsync, Ubuntu:Pro:16.04:LTS: rsync, Ubuntu:Pro:18.04:LTS: rsync, Ubuntu:20.04:LTS: rsync, Ubuntu:22.04:LTS: rsync, Ubuntu:24.04:LTS: rsync

VDE-2025-053 — Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware

Coreutils: heap overflow in split --line-bytes with very long lines Unprivileged overlay + shiftfs read access Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file SSL_select_next_proto buffer overread Remote Code Execution in pypa/setuptools

WID-SEC-W-2025-0084 — Rsync: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Rsync ausnutzen, um vertrauliche Informationen preiszugeben, sich erhöhte Rechte zu verschaffen und Daten zu manipulieren.