Samba Rsync vulnerabilities

CVE-2006-2083 [HIGH] CVE-2006-2083: Integer overflow in the receive_xattr function in the extended attributes patch (xattr Integer overflow in the receive_xattr function in the extended attributes patch (xattr.c) for rsync before 2.6.8 might allow attackers to execute arbitrary code via crafted extended attributes that trigger a buffer overflow.

CVE-2026-53798 [MEDIUM] CWE-704 CVE-2026-53798: rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an empty response for a uid or gid lookup, rsync incorre

CVE-2026-43617 [MEDIUM] CWE-289 CVE-2026-43617: Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's ho Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to den

CVE-2026-70459 [MEDIUM] CWE-908 CVE-2026-70459: rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child proce rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type,

CVE-2011-1097 [MEDIUM] CWE-119 CVE-2011-1097: rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows rem rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows remote rsync servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via malformed data.

CVE-2024-12747 [MEDIUM] CVE-2024-12747: A flaw was found in rsync A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive inf

CVE-2004-0426 [MEDIUM] CVE-2004-0426: rsync before 2 rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, which allows remote attackers to write files outside of the module's path.

CVE-2026-43620 [MEDIUM] CWE-125 CVE-2026-43620: Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted en

CVE-2026-53797 [MEDIUM] CWE-59 CVE-2026-53797: rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree trave rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with a symlink pointing outside the source root between path

CVE-2026-53800 [MEDIUM] CWE-59 CVE-2026-53800: rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feat rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rathe

CVE-2004-0792 [MEDIUM] CVE-2004-0792: Directory traversal vulnerability in the sanitize_path function in util Directory traversal vulnerability in the sanitize_path function in util.c for rsync 2.6.2 and earlier, when chroot is disabled, allows attackers to read or write certain files.

CVE-2025-10158 [MEDIUM] CVE-2025-10158: A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array ind A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue.

CVE-2017-17433 [LOW] CWE-862 CVE-2017-17433: The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 201 The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions.

CVE-2026-45232 [LOW] CWE-193 CVE-2026-45232: Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the est Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy se

CVE-2002-0080 [LOW] CWE-269 CVE-2002-0080: rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, whi rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, which could provide supplemental group privileges to local users, who could then read certain files that would otherwise be disallowed.