Release date:
2026-10-20 18:37:48 UTC
Description:
- CVE-2026-105840: reject absolute path names in restricted mode in lrz
(received files) and lsz (sent files), not only in PUBDIR builds
- CVE-2026-105841: remove the pipe mode that ran received files through a
shell command when lrz was invoked as rzCOMMAND
- CVE-2026-105842: allocate the received path name with strdup() instead of
a fixed PATH_MAX*2 buffer, and NUL-terminate the ZFILE subpacket
Updated packages:
-
lrzsz-0.12.20-55.el9_8.tuxcare.els1.aarch64.rpm
sha:a94fcf5c4615161465a257e9fdb42c72fa88e5c9af0107901db939b02adc14b6
-
lrzsz-0.12.20-55.el9_8.tuxcare.els1.i686.rpm
sha:ffa1308bd1161919d7dc40a7354f39cfc886800bbbd1c3632ad5cd6fb5a3b7a0
-
lrzsz-0.12.20-55.el9_8.tuxcare.els1.x86_64.rpm
sha:ef45af2f5dd654ef2455d58bb4170d70a746246b70ca7632ecb689162431b33e
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
