Debian LTS Advisory ([SECURITY] [DLA 1725-1] rsync security update)

Trail of Bits used the automated vulnerability discovery tools developed for the DARPA Cyber Grand Challenge to audit zlib. As rsync, a fast, versatile, remote (and local) file-copying tool, uses an embedded copy of zlib, those issues are also present in rsync. CVE-2016-9840 In order to avoid undefined behavior, remove offset pointer optimization, as this is not compliant with the C standard. CVE-2016-9841 Only use post-increment to be compliant with the C standard. CVE-2016-9842 In order to avoid undefined behavior, do not shift negative values, as this is not compliant with the C standard. CVE-2016-9843 In order to avoid undefined behavior, do not pre-decrement a pointer in big-endian CRC calculation, as this is not compliant with the C standard. CVE-2018-5764 Prevent remote attackers from being able to bypass the argument-sanitization protection mechanism by ignoring --protect-args when already sent by client.

rsync on Debian Linux

This check tests the installed software version using the apt package manager.

For Debian 8 'Jessie', these problems have been fixed in version 3.1.1-3+deb8u2. We recommend that you upgrade your rsync packages.