FS#8164 : Security bug in rsync

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!

FS#8164 - Security bug in rsync

Attached to Project: Arch Linux
Opened by Hussam Al-Tayeb (hussam) - Saturday, 29 September 2007, 21:57 GMT
Last edited by Tobias Powalowski (tpowa) - Sunday, 30 September 2007, 10:59 GMT

Task Type	Bug Report
Category	Security
Status	Closed
Assigned To	Tobias Powalowski (tpowa)
Architecture	All
Severity	High
Priority	Normal
Reported Version	2007.08.1
Due in Version	Undecided
Due Date	Undecided
Percent Complete
Votes	0
Private	No

Details

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4091

"Multiple off-by-one errors in the sender.c in rsync 2.6.9 might allow remote attackers to execute arbitrary code via directory names that are not properly handled when calling the f_name function. "

I'll attach the suse fix.

This task depends upon

Closed by Tobias Powalowski (tpowa)
Sunday, 30 September 2007, 10:59 GMT
Reason for closing: Fixed