Описание
Important: lrzsz security, bug fix, and enhancement update
Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.
Security Fix(es):
-
lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)
-
lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)
Bug Fix(es) and Enhancement(s):
- lrzsz: segfault with -s [rhel-8.10.z] (JIRA:Rocky Linux-282148)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Затронутые продукты
Rocky Linux 8
Связанные CVE
Исправления
- Red Hat - 2546590
- Red Hat - 2546595
Связанные уязвимости
ELSA-2026-86056: lrzsz security, bug fix, and enhancement update (IMPORTANT)
ELSA-2026-83525: lrzsz security, bug fix, and enhancement update (IMPORTANT)
lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.
lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.