Most recent entries from all

BELL-CVE-2026-53788

Affected: Alpaquita:23: rsync, Alpaquita:25: rsync, Alpaquita:stream: rsync

EUVD-2026-352612

fkie_cve-2026-53788

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.

msrc_CVE-2026-53788 — rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping

msrc_CVE-2026-53788

OESA-2026-3949 — rsync security update

Affected: openEuler:24.03-LTS-SP1: rsync

Rsync is an open source utility that provides fast incremental file transfer. It uses the &quot;rsync algorithm&quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand. Security Fix(es):

Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.(CVE-2026-43619)

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted…

openSUSE-SU-2026:11869-1 — rsync-3.5.1-1.1 on GA media

rsync-3.5.1-1.1 on GA media

SUSE-SU-2026:23253-1 — Security update for rsync

Security update for rsync

UBUNTU-CVE-2026-53788

Affected: Ubuntu:Pro:14.04:LTS: rsync, Ubuntu:Pro:16.04:LTS: rsync, Ubuntu:Pro:18.04:LTS: rsync, Ubuntu:Pro:20.04:LTS: rsync, Ubuntu:22.04:LTS: rsync, Ubuntu:24.04:LTS: rsync, Ubuntu:26.04:LTS: rsync

WID-SEC-W-2026-2817 — Rsync: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Rsync ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Daten offenzulegen oder zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder Denial-of-Service-Zustände herbeizuführen.