oss-sec mailing list archives

Re: UAF in rsync 3.4.1 and below

From: Alan Coopersmith <alan.coopersmith () oracle com>
Date: Thu, 16 Apr 2026 08:27:56 -0700

On 4/15/26 22:49, Przemyslaw Frasunek wrote:

7. TIMELINE

2008-03-07  Bug introduced in commit d724dd186 (rsync 3.0.1pre1).
             The commit added qsort to receive_xattr() for sorting xattrs
             after namespace prefix munging in --fake-super mode.
2026-04-16  This report.


Have you notified the rsync maintainers about this?  When?

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Current thread:

UAF in rsync 3.4.1 and below Przemyslaw Frasunek (Apr 15)
- Re: UAF in rsync 3.4.1 and below Alan Coopersmith (Apr 16)
  - Re: UAF in rsync 3.4.1 and below Salvatore Bonaccorso (Apr 16)
    - Re: UAF in rsync 3.4.1 and below Sam James (Apr 21)