Register | Log in

lrzsz

Tools for zmodem/xmodem/ymodem file transfer

Choose email to subscribe with

general

source: lrzsz (main)
version: 0.12.21rc-5
maintainer: Martin A. Godisch (DMD)
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.12.21-10
oldstable: 0.12.21-10
stable: 0.12.21rc-0.2
testing: 0.12.21rc-5
unstable: 0.12.21rc-5

versioned links

0.12.21-10: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.12.21rc-0.2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.12.21rc-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

lrzsz

action needed

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

In debian/watch no matching files for watch source
  https://github.com/UweOhse/lrzsz

Created: 2026-10-05 Last update: 2026-10-09 14:30

3 security issues in trixie high

There are 3 open security issues in trixie.

3 important issues:

CVE-2026-105840: lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user.
CVE-2026-105841: lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.
CVE-2026-105842: lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.

Created: 2026-10-07 Last update: 2026-10-07 18:19

3 security issues in sid high

There are 3 open security issues in sid.

3 important issues:

CVE-2026-105840: lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user.
CVE-2026-105841: lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.
CVE-2026-105842: lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.

Created: 2026-10-07 Last update: 2026-10-07 18:19

3 security issues in forky high

There are 3 open security issues in forky.

3 important issues:

CVE-2026-105840: lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user.
CVE-2026-105841: lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.
CVE-2026-105842: lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.

Created: 2026-10-07 Last update: 2026-10-07 18:19

3 security issues in bookworm high

There are 3 open security issues in bookworm.

3 important issues:

CVE-2026-105840: lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user.
CVE-2026-105841: lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.
CVE-2026-105842: lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.

Created: 2026-10-07 Last update: 2026-10-07 18:19

lintian reports 4 warnings normal

Lintian reports 4 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-08-23 Last update: 2026-09-14 10:01

debian/patches: 4 patches to forward upstream low

Among the 28 debian patches available in version 0.12.21rc-5 of the package, we noticed the following issues:

4 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2026-08-23 Last update: 2026-08-23 23:00

news

[2026-08-29] lrzsz 0.12.21rc-5 MIGRATED to testing (Debian testing watch)
[2026-08-23] Accepted lrzsz 0.12.21rc-5 (source) into unstable (Martin A. Godisch)
[2026-06-29] lrzsz 0.12.21rc-4 MIGRATED to testing (Debian testing watch)
[2026-06-19] Accepted lrzsz 0.12.21rc-4 (source) into unstable (Martin A. Godisch)
[2026-06-19] Accepted lrzsz 0.12.21rc-3 (source) into unstable (Martin A. Godisch)
[2026-06-18] Accepted lrzsz 0.12.21rc-2 (source) into unstable (Martin A. Godisch)
[2026-06-09] lrzsz 0.12.21rc-1 MIGRATED to testing (Debian testing watch)
[2026-06-04] Accepted lrzsz 0.12.21rc-1 (source) into unstable (Martin A. Godisch)
[2025-11-06] lrzsz 0.12.21rc-0.3 MIGRATED to testing (Debian testing watch)
[2025-11-01] Accepted lrzsz 0.12.21rc-0.3 (source) into unstable (Adrian Bunk)
[2025-01-14] lrzsz 0.12.21rc-0.2 MIGRATED to testing (Debian testing watch)
[2025-01-08] Accepted lrzsz 0.12.21rc-0.2 (source) into unstable (Niels Thykier)
[2024-09-18] lrzsz 0.12.21rc-0.1 MIGRATED to testing (Debian testing watch)
[2024-09-13] Accepted lrzsz 0.12.21rc-0.1 (source) into unstable (Bastian Germann) (signed by: bage@debian.org)
[2024-08-25] lrzsz REMOVED from testing (Debian testing watch)
[2024-03-27] lrzsz 0.12.21-11 MIGRATED to testing (Debian testing watch)
[2024-03-17] Accepted lrzsz 0.12.21-11 (source) into unstable (Martin A. Godisch)
[2022-01-25] Accepted lrzsz 0.12.21-8+deb9u1 (source amd64) into oldoldstable (Thorsten Alteholz)
[2018-05-03] lrzsz 0.12.21-10 MIGRATED to testing (Debian testing watch)
[2018-05-01] Accepted lrzsz 0.12.21-10 (source amd64) into unstable (Martin A. Godisch)
[2018-04-27] lrzsz 0.12.21-9 MIGRATED to testing (Debian testing watch)
[2018-04-22] Accepted lrzsz 0.12.21-9 (source) into unstable (Andrej Shadura)
[2015-06-19] lrzsz 0.12.21-8 MIGRATED to testing (Britney)
[2014-01-10] lrzsz 0.12.21-7 MIGRATED to testing (Debian testing watch)
[2013-12-30] Accepted lrzsz 0.12.21-7 (source amd64) (Martin A. Godisch)
[2013-12-28] Accepted lrzsz 0.12.21-6 (source amd64) (Martin A. Godisch)
[2009-12-05] lrzsz 0.12.21-5 MIGRATED to testing (Debian testing watch)
[2009-12-04] lrzsz 0.12.21-5 MIGRATED to testing (Debian testing watch)
[2009-11-23] Accepted lrzsz 0.12.21-5 (source amd64) (Martin A. Godisch)
[2006-01-24] lrzsz 0.12.21-4.1 MIGRATED to testing (Debian testing watch)

1
2

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 4)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (-, 100)
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.12.21rc-4
4 bugs (1 patch)

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing