Release date:
2026-09-16 17:28:33 UTC
Description:
- CVE-2026-70456: heap out-of-bounds write in the daemon read_args() because the
post-dot argv growth path (glob_expand()/glob_match()) reserved room only for
the entry being added, so a request line landing argc on exactly maxargs made
the trailing argv[argc] = NULL an 8-byte write one slot past the allocation;
the +1 slot is now ensured before the store
Updated packages:
-
rsync-3.1.3-12.el8_4.tuxcare.els16.x86_64.rpm
sha:45c9d5b2bd06f9ba07f085390b45ee3b328a877852ed1b201b81b0b8a61e713c
-
rsync-daemon-3.1.3-12.el8_4.tuxcare.els16.noarch.rpm
sha:f9121d8e2d1b3048b12efebfe3e106d6fe539a7f46121ad9662bbdff3bd84f35
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
