RHSA-2026:98481: Important: lrzsz security, bug fix, and enhancement update
Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.Security Fix(es): lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840) lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841) Bug Fix(es) and Enhancement(s): lrzsz: segfault with -s [rhel-9.9.z] (JIRA:RHEL-282118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/lrzszto a version that resolves this vulnerability.Fixed in 0.12.20-58.el9_9 - Upgrade
Upgrade
redhat/lrzsz-debuginfoto a version that resolves this vulnerability.Fixed in 0.12.20-58.el9_9 - Upgrade
Upgrade
redhat/lrzsz-debugsourceto a version that resolves this vulnerability.Fixed in 0.12.20-58.el9_9 - Upgrade
Upgrade
redhat/lrzszto a version that resolves this vulnerability.Fixed in 0.12.20-58.el9_9.aa - Upgrade
Upgrade
redhat/lrzsz-debuginfoto a version that resolves this vulnerability.Fixed in 0.12.20-58.el9_9.aa - Upgrade
Upgrade
redhat/lrzsz-debugsourceto a version that resolves this vulnerability.Fixed in 0.12.20-58.el9_9.aa
Event History
Frequently Asked Questions
Which lrzsz usage modes are implicated by the security fixes?
The arbitrary file overwrite issue affects restricted mode and relies on absolute path traversal. The arbitrary command execution issue affects pipe mode and relies on crafted file names.
What could an attacker achieve if the affected modes are used?
In restricted mode, an attacker could overwrite arbitrary files through absolute path traversal. In pipe mode, crafted file names could result in arbitrary command execution.
Which Red Hat packages are included in this update?
The update lists redhat/lrzsz, redhat/lrzsz-debuginfo, and redhat/lrzsz-debugsource.