Fluid Attacks Database

Description

Multiple off-by-one errors in the sender.c in rsync 2.6.9 might allow remote attackers to execute arbitrary code via directory names that are not properly handled when calling the f_name function.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	rsync	>=0 <2.6.9-5	2.6.9-5
debian 11	rsync	>=0 <2.6.9-5	2.6.9-5
debian 12	rsync	>=0 <2.6.9-5	2.6.9-5
debian 13	rsync	>=0 <2.6.9-5	2.6.9-5

Aliases

1. CVE-2007-40912. NVD-2007-40913. OSV-DEBIAN-2007-40914. OSV-2007-40915. SECURITY-TRACKER-CVE-2007-4091

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.