Release date:
2026-09-16 14:39:50 UTC
Description:
* SECURITY UPDATE: Out-of-bounds heap write in daemon argument parsing
- debian/patches/CVE-2026-70456.patch: grow argv to argc + 1 entries in
read_args() (io.c) before storing the trailing NULL, so a post-dot daemon
request whose glob expansion lands argc exactly on maxargs no longer
writes one pointer slot past the end of the argv allocation
- CVE-2026-70456
Updated packages:
-
rsync_3.1.2-2.1ubuntu1.6+tuxcare.els13_amd64.deb
sha:098166bcd74b03892d7f24262bc257b690ad546c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
