FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

rsync -- Multiple security fixes

Affected packages
		rsync	<	3.4.0

Details

VuXML ID	163edccf-d2ba-11ef-b10e-589cfc10a551
Discovery	2025-01-14
Entry	2025-01-14

rsync reports:

This update includes multiple security fixes:

CVE-2024-12084: Heap Buffer Overflow in Checksum Parsing

CVE-2024-12085: Info Leak via uninitialized Stack contents defeats ASLR

CVE-2024-12086: Server leaks arbitrary client files

CVE-2024-12087: Server can make client write files outside of destination directory using symbolic links

CVE-2024-12088: --safe-links Bypass

CVE-2024-12747: symlink race condition

[source]

References

CVE Name	CVE-2024-12084
CVE Name	CVE-2024-12085
CVE Name	CVE-2024-12086
CVE Name	CVE-2024-12087
CVE Name	CVE-2024-12088
CVE Name	CVE-2024-12747