lrzsz buffer overflow

[Felipe Gasper]

There’s a buffer overflow bug in lrzsz’s zsdata() function: if the length of the data to be sent is 0, then we spit out roughly 55,000 bytes.

This can be triggered by sending the abort sequence (0x18 0x18 0x18 0x18 0x18 0x08 0x08 0x08 0x08 0x08) to sz while sz is sending a file.

There’s a patch here: https://github.com/gooselinux/lrzsz/blob/master/lrzsz-0.12.20.patch

Where is the canonical repo for lrzsz now? Uwe Ohse doesn’t seem to maintain it actively anymore.

[Mike Salvatore (mikesalvatore)]

This issue has been assigned CVE-2017-10195 and has been resolved in the following Ubuntu releases:

trusty: 0.12.21-10~build0.14.04.1
xenial: 0.12.21-10~build0.16.04.1
bionic: 0.12.21-10~build0.18.04.1
cosmic: 0.12.21-10