Release date:
2026-10-20 13:44:39 UTC
Description:
- CVE-2026-105840: reject absolute path names in restricted mode in lrz
(received files) and lsz (sent files), not only in PUBDIR builds
- CVE-2026-105841: remove the pipe mode that ran received files through a
shell command when lrz was invoked as rzCOMMAND
- CVE-2026-105842: allocate the received path name with strdup() instead of
a fixed PATH_MAX*2 buffer, and NUL-terminate the ZFILE subpacket
Updated packages:
-
lrzsz-0.12.20-55.el9_6.tuxcare.els1.aarch64.rpm
sha:c6173c41e4851a0bb89587dfdba982b7553a7dd1eeddab1653f2a51bbc7a8e42
-
lrzsz-0.12.20-55.el9_6.tuxcare.els1.i686.rpm
sha:1f89b9a1dabd7675e1e64ef90b37e9a90d7f3a3d6ab08f903e8af186f397eeba
-
lrzsz-0.12.20-55.el9_6.tuxcare.els1.x86_64.rpm
sha:ba5af8aa5354b6f60df4ecf2e3f92c1fe23cdbca6ab7f4f1ba5da04d723dcd22
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
