Hi,

The following vulnerabilities were published for lrzsz.

CVE-2026-105840[0]:
| lrzsz before 0.13.0 contains a path traversal vulnerability in the
| lrz receive utility's restricted mode that allows malicious ZMODEM
| senders to write files outside the current directory using absolute
| pathnames. Because checkpath() in src/lrz.c only rejects '../'
| sequences unless built with --enable-pubdir, attackers can send
| files named with absolute paths to overwrite any file writable by
| the receiving user.


CVE-2026-105841[1]:
| lrzsz before 0.13.0 contains an OS command injection vulnerability
| in the lrz receive utility's pipe mode that allows remote senders to
| execute commands by supplying crafted filenames. When lrz runs under
| a suffixed name such as lrztar, procheader() in src/lrz.c passes the
| unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters
| execute as the receiving user.


CVE-2026-105842[2]:
| lrzsz before 0.13.0 contains a heap-based buffer overflow
| vulnerability in procheader() of the lrz receive utility when
| copying overlong sender-supplied filenames into Pathname. Malicious
| ZMODEM senders can supply filenames up to 8192 bytes, overflowing
| the buffer via sprintf() in pipe mode or strcpy() to corrupt heap
| memory and crash lrz.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-105840
https://www.cve.org/CVERecord?id=CVE-2026-105840
[1] https://security-tracker.debian.org/tracker/CVE-2026-105841
https://www.cve.org/CVERecord?id=CVE-2026-105841
[2] https://security-tracker.debian.org/tracker/CVE-2026-105842
https://www.cve.org/CVERecord?id=CVE-2026-105842

Regards,
Salvatore

Thanks for this bug report. These issues were already addressed, at
least in part, by 0.12.21rc-5. I'll upgrade the package to 0.13.1.

Kind regards,

Martin

addressed in 0.12.21rc-5. CVE-2026-105841 will be fixed in 0.13.1-1.

Martin

The CVE-2026-105841 code is contained but not reachable.
It is fixed by https://github.com/UweOhse/lrzsz/commit/9eef71ce20fda2b345ef8431359aec96121215bd

Evidence from the packaging:
- debian/rules:39 configures with --program-transform-name=s/l//, so
  bin_PROGRAMS=lrz lsz (src/Makefile.am:1) install as rz and sz, plus
  the install-exec-local links rb, rx, sb, sx (src/Makefile.am:18-29).
  No lrztar/rztar/lrzip name is shipped anywhere (tree-wide search: none).
- Topipe is set only in chkinvok() when the basename — after stripping
  leading -/dir and an optional v/l — has a non-null char at index 2: if
  (s[2] && protocol!=ZM_XMODEM) Topipe = 1; (src/lrz.c:1578).
  Trigger requires a >=3 char suffixed name like rztar/lrztar.
- All installed names are exactly 2 chars (rz, sz, rb, rx, sb), s[2] is \0),
  so Topipe is never set and the vulnerable popen(Pathname,"w") at
  src/lrz.c:1299 is unreachable via the packaged binaries.

Two caveats:
1. The vulnerable code is still compiled in, so exposure is purely a matter
   of invocation name. A local user or an enclosing program that creates a
   suffixed symlink/copy (ln -s /usr/bin/rz lrztar) would re-enable it. This
   matches the CVE/NEWS wording that the bug "was only accessible if the
   installer gave appended some string to the lrz (or rz) commands name."
   Debian does not do this.
2. This is separate from the -C/--allow-remote-commands ZCOMMAND rexec path
   (upstream 3dbc195), which is opt-in and additionally forced off in
   Restricted mode (default).

Hi Martin,

Would it be okay if I file the attached file as stable proposed update?

Thanks,
Bastian

Hi Bastian,

no objections, please go ahead.

Thank you,

Martin

We believe that the bug you reported is fixed in the latest version of
lrzsz, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150240@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Martin A. Godisch <godisch@debian.org> (supplier of updated lrzsz package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 13 Oct 2026 07:04:50 +0200
Source: lrzsz
Architecture: source
Version: 0.13.1-1
Distribution: unstable
Urgency: medium
Maintainer: Martin A. Godisch <godisch@debian.org>
Changed-By: Martin A. Godisch <godisch@debian.org>
Closes: 1150240
Changes:
 lrzsz (0.13.1-1) unstable; urgency=medium
 .
   * New upstream release, fixes CVE-2026-105840, CVE-2026-105841 and
     CVE-2026-105842, closes: #1150240.
   * Added debian/NEWS about options and features removed upstream.
   * Dropped almost all Debian patches that are now included upstream or no
     longer apply to the new code base.
   * Dropped DSZLOG support patch, see debian/NEWS.
   * Updated 02-rz-terminate-received-strings.diff: enlarge the receive buffer
     by one byte and clear it once after allocation, since a sender-supplied
     name that fills the whole subpacket has no NUL of its own, and the
     attribute parsing would otherwise start one byte past the buffer. Dropped
     its PATH_MAX length check, which is no longer needed.
   * Added lsz_manpage_default_typo.diff.
   * Dropped stale README.cvs.
   * Switched to debhelper compat level 14.
   * Switched debian/rules to a minimal dh rules file.
   * Dropped Priority and Rules-Requires-Root from debian/control.
   * Updated build-dependencies for upstream quickcheck test suite.
   * Converted debian/copyright to machine-readable format.
   * Added debian/upstream/metadata.
   * Updated watch file.
Checksums-Sha1:
 7560385519be18a5b7e58947f7aed117068a72aa 1896 lrzsz_0.13.1-1.dsc
 4fdefa37c39e6f41f9192924d119e1f8967f477f 483782 lrzsz_0.13.1.orig.tar.gz
 38dad7103525887f9ce5cd1c2bc4b21f3f4d3455 10520 lrzsz_0.13.1-1.debian.tar.xz
 e54902d2132d0dbf12d918cd760e605293d75bc7 5923 lrzsz_0.13.1-1_amd64.buildinfo
Checksums-Sha256:
 101aa555a422751d190e20183e13d66573c6a7f2856f7c6ac07f7ddd47d5fd4e 1896 lrzsz_0.13.1-1.dsc
 112f91059fbd118e016d800c1a5c5a1702e965d8b9bfbda6015e44e20bfb93c9 483782 lrzsz_0.13.1.orig.tar.gz
 0cede4418e5c3a2a0043f74913564fa366812c7479764c33351db7e08d762a8f 10520 lrzsz_0.13.1-1.debian.tar.xz
 a066eb8fd05901770904f69878d9b8f399f7ded060181c14de5ca066508875f6 5923 lrzsz_0.13.1-1_amd64.buildinfo
Files:
 3b76bc5e19751cf639bc97207407142b 1896 comm optional lrzsz_0.13.1-1.dsc
 5a4c4e4053512eb8a17bc2db73fec337 483782 comm optional lrzsz_0.13.1.orig.tar.gz
 1799174e05de5c11e477b696229889d3 10520 comm optional lrzsz_0.13.1-1.debian.tar.xz
 98127ceded92770fadf90715f8389b04 5923 comm optional lrzsz_0.13.1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJHBAEBCgAxFiEEGEIyO0/Pm5CZX6F/o1C5kfBaSFcFAmrNvL4THGdvZGlzY2hA
ZGViaWFuLm9yZwAKCRCjULmR8FpIV05LD/42Ie2FWm9RzOWqFsjdYz23xd0rAkSb
NGBVwgkr3GAEwhwg7umKbgEJjHQ1BC19IeIQxI9Ll6M+uZOp4HT060qA/QPRKtJx
AXCzyQm+HJXQAioWhLc+0EsC9NxtaO+PcwT7KaAytoZ9pHfSKX+R7IAp7sZqMiAS
6r8gNv/Rz+Y9KTeruAy+X8AM0wxDYEDvvcIza5enni1C0eUZpHk/C0hySpPvlswR
Xdi5YIz+sO5Qx46zOw3E8qpMte5w+gCptfeG/kM9MeF924icUyxnmIfhNtERHafj
dILuuaKWntbZYIW0Dk9z4asuCySi1rG7bRgLMsoLtd+Ug4BAsWsQ8jbY8SqIYKh7
fyuC+8JCUlFN3iwp06OqHGLZfHH12j0WNICKJMiswU5sJtd+S+OFzLr+GaQP1LiJ
5OO6/j3VQcRzgyB5hwcRQ4RvE63IkORmR2Fq6EBopnR3uxqfcXGrJWuGn7bCExhZ
v8Vf7B7ZAeHhy6WnkHGGXme/nzeNVU7aRWocIyllbV6K5wIR2FbPAOLUVNQAouc/
BTB52fKyd6CbyTZJHv2M+kQlM/BSQGmCuV0dD2B6nD/nydfojxumaL/j/75Na4vh
f7EOTYkrFuoECOvyWyPAdQTj3YV+tQuH4V5Bx6BaEVGQErOQcz2AbEiuQJy8RgcU
sPjy7/ulYxCiXw==
=cMWH
-----END PGP SIGNATURE-----