Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:lrzsz User: [email protected] Usertags: pu
[ Reason ] Fix CVE-2026-105840 and CVE-2026-105842 (see #1150240). [ Impact ] Users are vulnerable to the two bugs. [ Tests ] Just compile-tested. [ Risks ] Two more checks and two additional NUL bytes. Pretty trivial, so not very risky. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] Include two upstream patches to address the two CVEs. [ Other info ] The maintainer agreed to this stable update request at #1150240.
diff -Nru lrzsz-0.12.21rc/debian/changelog lrzsz-0.12.21rc/debian/changelog --- lrzsz-0.12.21rc/debian/changelog 2025-01-01 13:16:48.000000000 +0100 +++ lrzsz-0.12.21rc/debian/changelog 2026-10-11 23:22:00.000000000 +0200 @@ -1,3 +1,14 @@ +lrzsz (0.12.21rc-0.2+deb13u1) trixie; urgency=medium + + * CVE-2026-105840, 01-rz-reject-absolute-paths.diff: + reject sender-supplied absolute paths in rz restricted mode. + * CVE-2026-105842, 02-rz-terminate-received-strings.diff: + reject over-length received file names, + fixing an out-of-bounds read and a one-byte heap overwrite on + maximum-length ZFILE names; also terminate the receiver buffer. + + -- Bastian Germann <[email protected]> Sun, 11 Oct 2026 23:22:00 +0200 + lrzsz (0.12.21rc-0.2) unstable; urgency=medium * Non-maintainer upload. diff -Nru lrzsz-0.12.21rc/debian/patches/01-rz-reject-absolute-paths.diff lrzsz-0.12.21rc/debian/patches/01-rz-reject-absolute-paths.diff --- lrzsz-0.12.21rc/debian/patches/01-rz-reject-absolute-paths.diff 1970-01-01 01:00:00.000000000 +0100 +++ lrzsz-0.12.21rc/debian/patches/01-rz-reject-absolute-paths.diff 2026-10-11 23:20:12.000000000 +0200 @@ -0,0 +1,18 @@ +Description: rz: reject absolute pathnames in restricted mode + Without PUBDIR (the Debian default build) checkpath() only rejected the + literal "../" and accepted sender-supplied absolute pathnames, so a remote + sender could create files and directories at any receiver-writable absolute + path. Reject a leading '/' when no PUBDIR is configured, restoring the + restricted-mode behaviour that rz(1) documents. +Forwarded: no +--- fixed.orig/src/lrz.c ++++ fixed/src/lrz.c +@@ -1629,6 +1629,8 @@ checkpath(const char *name) + #ifdef PUBDIR + || (name[0]== '/' && strncmp(name, PUBDIR, + strlen(PUBDIR))) ++#else ++ || (name[0] == '/') + #endif + ) { + canit(STDOUT_FILENO); diff -Nru lrzsz-0.12.21rc/debian/patches/02-rz-terminate-received-strings.diff lrzsz-0.12.21rc/debian/patches/02-rz-terminate-received-strings.diff --- lrzsz-0.12.21rc/debian/patches/02-rz-terminate-received-strings.diff 1970-01-01 01:00:00.000000000 +0100 +++ lrzsz-0.12.21rc/debian/patches/02-rz-terminate-received-strings.diff 2026-10-11 23:20:12.000000000 +0200 @@ -0,0 +1,45 @@ +Description: rz: bound received file name length and terminate data subpackets + zrdata()/zrdat32() left the receive buffer unterminated, and procheader() then + read the name with strlen() and parsed trailing attributes at + name + 1 + strlen(name). A maximum-length ZFILE name without a NUL byte caused + an out-of-bounds read, and copying such a name into the PATH_MAX*2 Pathname + buffer overran it by one byte. Terminate the buffer after the payload, and + reject names of PATH_MAX or longer in procheader(): on this platform PATH_MAX + (4096) is below the receive buffer size, so the bound keeps both the attribute + parsing and the Pathname copy inside their buffers, and such names cannot name + a file anyway. +Forwarded: no +--- fixed.orig/src/zm.c ++++ fixed/src/zm.c +@@ -576,6 +576,7 @@ crcfoo: + return ERROR; + } + *bytes_received = length - (end - buf); ++ *buf = '\0'; /* terminate: name/attn parsed as C string */ + COUNT_BLK(*bytes_received); + VPRINTF(3,("zrdata: %lu %s", (unsigned long) (*bytes_received), + Zendnames[(d-GOTCRCE)&3])); +@@ -636,6 +637,7 @@ crcfoo: + return ERROR; + } + *bytes_received = length - (end - buf); ++ *buf = '\0'; /* terminate: name/attn parsed as C string */ + COUNT_BLK(*bytes_received); + VPRINTF(3,("zrdat32: %lu %s", (unsigned long) *bytes_received, + Zendnames[(d-GOTCRCE)&3])); +--- fixed.orig/src/lrz.c ++++ fixed/src/lrz.c +@@ -1141,6 +1141,13 @@ procheader(char *name, struct zm_fileinf + name=p; + } + } ++ if (strlen(name) >= PATH_MAX) { ++ /* over-long names cannot open and would overrun nameend/Pathname */ ++ if (Verbose) { ++ vstringf(_("file name too long, skipped: %s\n"), name); ++ } ++ return ERROR; ++ } + name_static=malloc(strlen(name)+1); + if (!name_static) + error(1,0,_("out of memory")); diff -Nru lrzsz-0.12.21rc/debian/patches/series lrzsz-0.12.21rc/debian/patches/series --- lrzsz-0.12.21rc/debian/patches/series 2024-09-13 08:57:20.000000000 +0200 +++ lrzsz-0.12.21rc/debian/patches/series 2026-10-11 23:20:37.000000000 +0200 @@ -13,3 +13,5 @@ ansi2knr.diff gettext_external.diff ignore-intl.diff +01-rz-reject-absolute-paths.diff +02-rz-terminate-received-strings.diff
