CVE-2014-9512
rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in...
rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.
Exploit likelihood
What each source reports
NVD Score used
rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.
- Record
CVE-2014-9512- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.
- Record
CVE-2014-9512- Updated
- 2026-11-02
EUVDEUVD-2014-9327 No score
rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.
- Record
EUVD-2014-9327- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gc42-wr8h-vr6f No score
rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in...
rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.
- Record
GHSA-gc42-wr8h-vr6f- Weakness
- CWE-59
- Updated
- 2026-11-02
OSV No score
rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.
- Record
CVE-2014-9512- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9512 No score
rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.
- Record
DEBIAN-CVE-2014-9512- Updated
- 2026-11-02
Show 7 moreShow less
OSVopenSUSE-SU-2024:10548-1 No score
rsync-3.1.2-1.5 on GA media
These are all security issues fixed in the rsync-3.1.2-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10548-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0173-1 No score
Security update for rsync
This update for rsync fixes two security issues and two non-security bugs.
The following vulnerabilities were fixed:
- CVE-2014-8242: Checksum collisions leading to a denial of service (bsc#900914)
- CVE-2014-9512: Malicious servers could send files outside of the transferred directory (bsc#915410)
The following non-security bugs were fixed:
- bsc#922710: Prevent rsyncd from spamming the log when trying to register SLP.
- bsc#898513: slp support broke rsync usage.
- Record
SUSE-SU-2016:0173-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0176-1 No score
Security update for rsync
This update for rsync fixes two security issues:
- CVE-2014-8242: Checksum collisions leading to a denial of service (bsc#900914)
- CVE-2014-9512: Malicious servers could send files outside of the transferred directory (bsc#915410)
- Record
SUSE-SU-2016:0176-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1866-1 No score
Security update for rsync
rsync was updated to fix one security issue.
- CVE-2014-9512: rsync allowed remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path (bsc#915410).
- Record
SUSE-SU-2016:1866-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:2151-1 No score
Security update for rsync
rsync was updated to fix one security issue.
- CVE-2014-9512: rsync allowed remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path (bsc#915410).
- Record
SUSE-SU-2016:2151-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-9512 No score
rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.
- Record
UBUNTU-CVE-2014-9512- Updated
- 2026-11-02
OSVUSN-2879-1 No score
rsync vulnerability
It was discovered that rsync incorrectly handled invalid filenames. A malicious server could use this issue to write files outside of the intended destination directory.
- Record
USN-2879-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rsyncDebian:12 |
before 3.1.1-3 | 3.1.1-3 |
rsyncDebian:13 |
before 3.1.1-3 | 3.1.1-3 |
rsyncDebian:14 |
before 3.1.1-3 | 3.1.1-3 |
rsyncSUSE:Linux Enterprise Desktop 12 From an advisory covering 2 CVEs |
before 3.1.0-6.1 | 3.1.0-6.1 |
rsyncSUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 2 CVEs |
before 3.1.0-6.1 | 3.1.0-6.1 |
rsyncSUSE:Linux Enterprise Server 12 From an advisory covering 2 CVEs |
before 3.1.0-6.1 | 3.1.0-6.1 |
rsyncSUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 2 CVEs |
before 3.1.0-6.1 | 3.1.0-6.1 |
rsyncSUSE:Linux Enterprise Server 12 SP1 From an advisory covering 2 CVEs |
before 3.1.0-6.1 | 3.1.0-6.1 |
rsyncSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 2 CVEs |
before 3.1.0-6.1 | 3.1.0-6.1 |
rsyncSUSE:Linux Enterprise Desktop 11 SP3 From an advisory covering 2 CVEs |
before 3.0.4-2.49.1 | 3.0.4-2.49.1 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rsyncSUSE:Linux Enterprise Desktop 11 SP4 From an advisory covering 2 CVEs |
before 3.0.4-2.49.1 | 3.0.4-2.49.1 |
rsyncSUSE:Linux Enterprise Server 11 SP3 From an advisory covering 2 CVEs |
before 3.0.4-2.49.1 | 3.0.4-2.49.1 |
rsyncSUSE:Linux Enterprise Server 11 SP3-TERADATA From an advisory covering 2 CVEs |
before 3.0.4-2.49.1 | 3.0.4-2.49.1 |
rsyncSUSE:Linux Enterprise Server for SAP Applications 11 SP3 From an advisory covering 2 CVEs |
before 3.0.4-2.49.1 | 3.0.4-2.49.1 |
rsyncSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 2 CVEs |
before 3.0.4-2.49.1 | 3.0.4-2.49.1 |
rsyncSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 2 CVEs |
before 3.0.4-2.49.1 | 3.0.4-2.49.1 |
rsyncSUSE:Linux Enterprise Server 11 SP4 |
before 3.0.4-2.52.1 | 3.0.4-2.52.1 |
rsyncSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 3.0.4-2.52.1 | 3.0.4-2.52.1 |
rsyncSUSE:Linux Enterprise Desktop 12 SP1 |
before 3.1.0-9.3 | 3.1.0-9.3 |
rsyncSUSE:Linux Enterprise Server 12 SP1 |
before 3.1.0-9.3 | 3.1.0-9.3 |
rsyncSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 3.1.0-9.3 | 3.1.0-9.3 |
rsyncUbuntu:14.04:LTS |
before 3.1.0-2ubuntu0.2, plus listed versions 3.0.9-4ubuntu13.1.0-23.1.0-2ubuntu0.1 |
3.1.0-2ubuntu0.2 |
rsyncopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 3.1.2-1.5 | 3.1.2-1.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9512 is a medium vulnerability (CVSS 6.4) in Samba Rsync, published February 12, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.50%, the 93rd percentile. Fixed in rsync 3.1.1-3.
References
securitytracker.com/id/1034786
securityfocus.com/bid/76093
security.gentoo.org/glsa/201605-04
lists.opensuse.org/opensuse-updates/2016-06/msg00112.html
bugzilla.samba.org/show_bug.cgi?id=10977
Show 27 moreShow less
xteam.baidu.com?p=169
ubuntu.com/usn/USN-2879-1
oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
support.apple.com/kb/HT211170
nvd.nist.gov/vuln/detail/CVE-2014-9512
github.com/advisories/GHSA-gc42-wr8h-vr6f
security-tracker.debian.org/tracker/CVE-2014-9512
suse.com/support/update/announcement/2016/suse-su-20160173-1
bugzilla.suse.com/898513
ubuntu.com/security/CVE-2014-9512
cve.org/CVERecord?id=CVE-2014-9512