Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: Uwe Ohse lrzsz — lrzsz 0.13.0 security changes Clear all filters
TI-2026-68425 CVE-2026-105842 · GHSA-3cw3-cf87-8pwp

Heap buffer overflow in lrzsz lrz when receiving long filenames

Priority LOW 27

lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname.

CVSS 4.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00206 Published 2026-10-06 Partial fix · 0.13.0 CWE-122
TI-2026-68424 CVE-2026-105841 · GHSA-w9c3-4vq7-c452

OS command injection in lrzsz lrz pipe mode

Priority LOW 37

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00935 Published 2026-10-06 Partial fix · 0.13.0 CWE-78
TI-2026-68423 CVE-2026-105840 · GHSA-3hwf-cvfh-5874

Path traversal in lrzsz lrz restricted mode lets senders overwrite files

Priority LOW 35

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00313 Published 2026-10-06 Partial fix · 0.13.0 CWE-22