CLSA-2026-1792422501
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792422501.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1792422501
- Upstream
CVE (3)
- CVE-2026-105840
- CVE-2026-105841
- CVE-2026-105842
- Published
- 2026-10-19T15:08:34Z
- Modified
- 2026-10-26T09:32:04Z
- Summary
- Fix CVE(s): CVE-2026-105840, CVE-2026-105841, CVE-2026-105842
- Details
-
- SECURITY UPDATE: absolute path names accepted in restricted mode
- debian/patches/CVE-2026-105840.patch: reject absolute path names in restricted mode in checkpath() in src/lrz.c and wcs() in src/lsz.c, not only in PUBDIR builds
- CVE-2026-105840
- SECURITY UPDATE: command injection via the pipe mode
- debian/patches/CVE-2026-105841.patch: remove the pipe mode that ran received files through a shell command when lrz was invoked as rzCOMMAND, in src/lrz.c
- CVE-2026-105841
- SECURITY UPDATE: heap buffer overflow via a long file name
- debian/patches/CVE-2026-105842.patch: allocate the received path name with strdup() instead of a fixed PATH_MAX*2 buffer, and NUL-terminate the ZFILE subpacket, in src/lrz.c
- CVE-2026-105842
- SECURITY UPDATE: absolute path names accepted in restricted mode
- References