Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| High | n/a | RHSA-2026:89755 |
lrzsz security, bug fix, and enhancement update
Red Hat, lrzszRed Hat Enterprise Linux 9, lrzsz
|
Red Hat Security Advisories | |||
|
RHSA-2026:89755lrzsz security, bug fix, and enhancement update
Executive summaryRed Hat advisory RHSA-2026:89755 covers the lrzsz file transfer package on Red Hat Enterprise Linux 9 and several related subscription variants. Red Hat rates the update Important and lists two security flaws, one allowing arbitrary file overwrite and one allowing arbitrary command execution. Red Hat recommends applying the updated lrzsz packages as described in its update instructions. Technical summaryThe advisory describes two flaws in lrzsz. CVE-2026-105840 is an arbitrary file overwrite via absolute path traversal in restricted mode, and CVE-2026-105841 is arbitrary command execution via crafted file names in pipe mode. The advisory does not state the attack vector, required user interaction, or CVSS scores, and it refers to the CVE pages for those details. The fixed package version is lrzsz-0.12.20-58.el9_8, and the advisory does not state any workaround or detection guidance. The advisory also includes a non-security segfault fix with -s. Remediation is described at https://access.redhat.com/articles/11258. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89755 ScoreNo CVSS score published. Affects
Red Hat Product SecurityPublished
Read the advisory
|
|||||||