CVE-2017-17434: The daemon in rsync did not check for fnamecmp filenames in
the daemonfilterlist data structure (in the recvfiles function in
receiver.c) and also did not apply the sanitizepaths protection mechanism to
pathnames found in 'xname follows' strings (in the readndxand_attrs function
in rsync.c), which allowed remote attackers to bypass intended access
restrictions' (bsc#1071460).
CVE-2017-17433: The recvfiles function in receiver.c in the daemon in rsync,
proceeded with certain file metadata updates before checking for a filename in
the daemonfilter_list data structure, which allowed remote attackers to bypass
intended access restrictions (bsc#1071459).
CVE-2017-16548: The receive_xattr function in xattrs.c in rsync did not check
for a trailing '\0' character in an xattr name, which allowed remote attackers
to cause a denial of service (heap-based buffer over-read and application
crash) or possibly have unspecified other impact by sending crafted data to the
daemon (bsc#1066644).