Vulnerabilities

TI-2026-12978 CVE-2026-15422 · GHSA-7fj7-gprr-x7fm

SCTP needs to better-check INIT ACK chunk parameters

MEDIUM 49

The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00882 Published 2026-07-16 Fixed in r151058j, r151056aj +2 CWE-122

TI-2026-12996 CVE-2026-15449 · GHSA-5jqp-7hrf-w792

TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruption

LOW 25

A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld.

CVSS 4.0MEDIUM 5.8 Local Low privileges No interaction EPSS 0.00116 Published 2026-07-16 Fixed in r151058j, r151056aj +2 CWE-122

TI-2024-11208 CVE-2024-12084 · GHSA-85h7-m8c3-v9wc

Rsync: heap buffer overflow in rsync due to improper checksum length handling

CRITICAL 87

A heap-based buffer overflow flaw was found in the rsync daemon.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.72514 Published 2025-01-15 Fixed in 3.4.1-2.el10 CWE-122

TI-2024-11211 CVE-2024-12087 · GHSA-9x68-7qq6-v523

Rsync: path traversal vulnerability in rsync

HIGH 66

A path traversal vulnerability exists in rsync.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02259 Published 2025-01-14 Partial fix · 3.4.1-2.el10, 3.0.6-12.el6_10.2 +11 CWE-22

TI-2024-11212 CVE-2024-12088 · GHSA-ffph-g3pc-8r3g

Rsync: --safe-links option bypass leads to path traversal

HIGH 66

A flaw was found in rsync.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04646 Published 2025-01-14 Partial fix · 3.4.1-2.el10, 3.1.3-21.el8_10 +2 CWE-22

TI-2024-11210 CVE-2024-12086 · GHSA-82c6-8mfc-c23h

Rsync: rsync server leaks arbitrary client files

MEDIUM 63

A flaw was found in rsync.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.01789 Published 2025-01-14 Partial fix · 3.4.1-2.el10, 3.2.5-7.el9_8 +2 CWE-390

TI-2024-11209 CVE-2024-12085 · GHSA-xh5q-pch5-g3xq

Rsync: info leak via uninitialized stack contents

HIGH 72

A flaw was found in rsync which could be triggered when rsync compares file checksums.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.08641 Published 2025-01-14 Fixed in 3.4.1-2.el10, 3.0.6-12.el6_10.1 +209 CWE-908