rsync (SUSE:Linux Enterprise Server for SAP Applications 11 SP4) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Server for SAP Applications 11 SP4 package rsync, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (6)

• CVE-2017-16548 — CVSS 9.8 (critical): The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name…
• CVE-2017-17434 — CVSS 9.8 (critical): The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data…
• CVE-2018-5764 — CVSS 7.5 (high): The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows…
• CVE-2014-9512 — CVSS 6.4 (medium): rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.
• CVE-2014-8242 — CVSS 5.8 (medium): librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for remote attackers to modify transmitted data…
• CVE-2017-17433 — CVSS 3.7 (low): The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file…