-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 23 Aug 2026 10:17:41 +0200
Source: lrzsz
Architecture: source
Version: 0.12.21rc-5
Distribution: unstable
Urgency: medium
Maintainer: Martin A. Godisch <godisch@debian.org>
Changed-By: Martin A. Godisch <godisch@debian.org>
Changes:
lrzsz (0.12.21rc-5) unstable; urgency=medium
.
* Fix a series of security-related bugs. Thanks to Daniel Birtwhistle for
bringing these to our attention and for his support during patch
verification:
* 01-rz-reject-absolute-paths.diff: reject sender-supplied absolute paths
in rz restricted mode.
* 02-rz-terminate-received-strings.diff: reject over-length received file
names, fixing an out-of-bounds read and a one-byte heap overwrite on
maximum-length ZFILE names; also terminate the receiver buffer.
* 03-rz-junk-path-double-free.diff: fix a double-free and a use-after-free
when a --junk-path name ends in '/'.
* 04-rz-null-flag-use-after-free.diff: fix use-after-free with -D/--null.
Checksums-Sha1:
13dd8db6f153e95974dd1af8670df68e06e8cd38 1884 lrzsz_0.12.21rc-5.dsc
22f6c2b8bfd9645395322b7f828b29af6dc922e5 25984 lrzsz_0.12.21rc-5.debian.tar.xz
47fae83d1624d18d42b2422738f48f37eefaad80 5606 lrzsz_0.12.21rc-5_amd64.buildinfo
Checksums-Sha256:
28876112ae3dc9fb4e40f9153c3e697066487e0658ac8419fd5525e026bb24b1 1884 lrzsz_0.12.21rc-5.dsc
c099649ac70f01779657f59bd9d01bdbf06889027d53f7ed4dc651fb5f0b73ae 25984 lrzsz_0.12.21rc-5.debian.tar.xz
349dc82f5d5a8afe98081d3ac912b1797cd713c6baef861fc58009cda5c29c6c 5606 lrzsz_0.12.21rc-5_amd64.buildinfo
Files:
4feae8805bb363470ab547bcce6be69f 1884 comm optional lrzsz_0.12.21rc-5.dsc
aa123559973587df45af8585bc761f7c 25984 comm optional lrzsz_0.12.21rc-5.debian.tar.xz
25eff3fa8ec3618ab0704092cf57af14 5606 comm optional lrzsz_0.12.21rc-5_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJHBAEBCgAxFiEEGEIyO0/Pm5CZX6F/o1C5kfBaSFcFAmqKrNUTHGdvZGlzY2hA
ZGViaWFuLm9yZwAKCRCjULmR8FpIV7bzEACNOiY6kY/36GJKbIeJ+FpUotfb1dG5
ACzf5lUo78HWqQ1TGIp4bjRkV9SOp1ylEQdlkj/0rYOdk97OR9WUNhkHcsYxS/ur
3/9yFzshH8Cd/AcaoGm2fO1jGsoKR0TrgXJvyWuEwKgaRetLiuTt/cmtN9i1QLFx
fmzGk8dZBuwBWQlI04NVotQo2K9h0eTENZnNVFJ37zV5XTBEKfMahadZ0QXg79m8
Xy85dFYCI11CdlUVrUoCRtn6AaHTFtFH5j7ZIVYd8XCWkBfxk3m7ITQzkUrawDjk
MeSWPsLS8A868Onku4UCye4Yze6TEFKic7lY1vxex+WADkKlaD4A4KyUY4+M1cGM
vMxgbwJqkr5ZZqDv4JkFM6mT3eySqSzr4MfF+5iBPfMhCnc6g010lyxRO9HxV8r5
Tu0HLfmNTgyaAraRpR2ZYWuOA9fioqWcexN+BgJ8IJAPrAM5oRY8K13twk6UZLdY
EMn1WEvGT7B6qwksVCdNp9IE99ZUVjrq4NI8Q3mRhGmlp841j9KJoAJNyLsHItxC
H63yC7bylc1VGaMez2roPqGlFVitYlu4mnfb/WrtBIM0a0LcK/bC7F/pvBQTrHZ2
Fi5Iy+C50qLX6STh+JawwS+xvrVXLyf/I9qnQVelqRAFmdnQeYS88FNDG68mSeQ+
mpGwz0qLktHy2A==
=aXC8
-----END PGP SIGNATURE-----
