Lrzsz
Monthly
OS command injection in lrzsz before 0.13.0 allows a remote ZMODEM/YMODEM sender to execute arbitrary shell commands as the receiving user by supplying a crafted filename during an lrz receive. The flaw is reachable only when lrz is invoked under a suffixed/alias name such as lrztar and operates in pipe mode, where procheader() in src/lrz.c forwards the unescaped filename to popen() and shell metacharacters are interpreted. Successful exploitation requires the victim to accept or initiate the transfer (UI:P) and yields command execution at the receiver's privilege level only (no cross-system impact per SC:N/SI:N/SA:N); no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-supplied CVSS 4.0 score is 7.7 (High) while an independent assessment rates it CVSS 3.1 8.1 with AC:H given the non-default invocation and interaction prerequisites.
Arbitrary file write through path traversal in lrzsz before 0.13.0 lets a malicious ZMODEM sender place files outside the current directory - including by absolute pathname - when the victim runs the lrz receive utility in restricted mode. Exploitation requires the victim to actively initiate or accept a ZMODEM transfer (UI:P/AT:P), the binary to be built without the --enable-pubdir option (the default, since only that build hardens checkpath()), and the attacker to control the sending side; the primitive is limited to files the receiving user account can already write, though overwriting SSH keys, shell profiles, or cron entries can extend impact. No public exploit identified at time of analysis, and the risk is a conditional integrity/availability issue rather than a mass-exploitation emergency given the user-interaction and build-configuration prerequisites.
Heap memory corruption in the lrzsz lrz ZMODEM receive utility (all versions before 0.13.0) allows a malicious or compromised ZMODEM sender to overflow the fixed-size Pathname buffer in procheader() by supplying an overlong filename of up to 8192 bytes, crashing lrz and potentially enabling limited heap manipulation. Exploitation is not passive: the victim must be actively running the lrz receive utility and accept an inbound transfer from the attacker-controlled sender (UI:P/AT:P), and the demonstrated primary impact is denial of service rather than confirmed remote code execution. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV; the overall real-world risk is constrained by these preconditions, consistent with a moderate-severity rating.
OS command injection in lrzsz before 0.13.0 allows a remote ZMODEM/YMODEM sender to execute arbitrary shell commands as the receiving user by supplying a crafted filename during an lrz receive. The flaw is reachable only when lrz is invoked under a suffixed/alias name such as lrztar and operates in pipe mode, where procheader() in src/lrz.c forwards the unescaped filename to popen() and shell metacharacters are interpreted. Successful exploitation requires the victim to accept or initiate the transfer (UI:P) and yields command execution at the receiver's privilege level only (no cross-system impact per SC:N/SI:N/SA:N); no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-supplied CVSS 4.0 score is 7.7 (High) while an independent assessment rates it CVSS 3.1 8.1 with AC:H given the non-default invocation and interaction prerequisites.
Arbitrary file write through path traversal in lrzsz before 0.13.0 lets a malicious ZMODEM sender place files outside the current directory - including by absolute pathname - when the victim runs the lrz receive utility in restricted mode. Exploitation requires the victim to actively initiate or accept a ZMODEM transfer (UI:P/AT:P), the binary to be built without the --enable-pubdir option (the default, since only that build hardens checkpath()), and the attacker to control the sending side; the primitive is limited to files the receiving user account can already write, though overwriting SSH keys, shell profiles, or cron entries can extend impact. No public exploit identified at time of analysis, and the risk is a conditional integrity/availability issue rather than a mass-exploitation emergency given the user-interaction and build-configuration prerequisites.
Heap memory corruption in the lrzsz lrz ZMODEM receive utility (all versions before 0.13.0) allows a malicious or compromised ZMODEM sender to overflow the fixed-size Pathname buffer in procheader() by supplying an overlong filename of up to 8192 bytes, crashing lrz and potentially enabling limited heap manipulation. Exploitation is not passive: the victim must be actively running the lrz receive utility and accept an inbound transfer from the attacker-controlled sender (UI:P/AT:P), and the demonstrated primary impact is denial of service rather than confirmed remote code execution. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV; the overall real-world risk is constrained by these preconditions, consistent with a moderate-severity rating.