[CLSA-2026:1792422501] Fix CVE(s): CVE-2026-105840, CVE-2026-105841, CVE-2026-105842

Type:

security

Severity:

Important

Release date:

2026-10-19 15:08:34 UTC

Description:

   * SECURITY UPDATE: absolute path names accepted in restricted mode
     - debian/patches/CVE-2026-105840.patch: reject absolute path names in
       restricted mode in checkpath() in src/lrz.c and wcs() in src/lsz.c,
       not only in PUBDIR builds
     - CVE-2026-105840
   * SECURITY UPDATE: command injection via the pipe mode
     - debian/patches/CVE-2026-105841.patch: remove the pipe mode that ran
       received files through a shell command when lrz was invoked as
       rzCOMMAND, in src/lrz.c
     - CVE-2026-105841
   * SECURITY UPDATE: heap buffer overflow via a long file name
     - debian/patches/CVE-2026-105842.patch: allocate the received path name
       with strdup() instead of a fixed PATH_MAX*2 buffer, and NUL-terminate
       the ZFILE subpacket, in src/lrz.c
     - CVE-2026-105842

CVEs fixed:

Updated packages:

lrzsz_0.12.21-10~build0.18.04.1+tuxcare.els1_amd64.deb
sha:122b6cb209b05bd17916f3b46e361fe94670479d

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.