- Home
- CVEs with nessus.description==This update for rsync fixes several issues. These security issues were
fixed :
- CVE-2017-17434: The daemon in rsync did not check for
fnamecmp filenames in the daemon_filter_list data
structure (in the recv_files function in receiver.c) and
also did not apply the sanitize_paths protection
mechanism to pathnames found in 'xname follows' strings
(in the read_ndx_and_attrs function in rsync.c), which
allowed remote attackers to bypass intended access
restrictions' (bsc#1071460).
- CVE-2017-17433: The recv_files function in receiver.c in
the daemon in rsync, proceeded with certain file
metadata updates before checking for a filename in the
daemon_filter_list data structure, which allowed remote
attackers to bypass intended access restrictions
(bsc#1071459).
- CVE-2017-16548: The receive_xattr function in xattrs.c
in rsync did not check for a trailing '\\0' character in
an xattr name, which allowed remote attackers to cause a
denial of service (heap-based buffer over-read and
application crash) or possibly have unspecified other
impact by sending crafted data to the daemon
(bsc#1066644).
The update package also includes non-security fixes. See advisory for
details.
Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.
Max CVSS | 0 |
Min CVSS | 0 |
Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published |
Back to Top
Mark selected
Back to Top