Every CVE Search/ Get API key

CVE-2018-10195

lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect...

7.1 HighFix available

lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
High

Exploit likelihood

0.39%Down 0.6 points since Jun 3, 2021
90%50%10%1%

What each source reports

NVD Score used 7.1

lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.

Record
CVE-2018-10195
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0
3.6 LowAV:L/AC:L/Au:N/C:P/I:N/A:P
Weakness
CWE-190
Updated
2026-11-02
CVE List No score

lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.

Record
CVE-2018-10195
Updated
2026-11-02
EUVDEUVD-2018-2271 No score

lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.

Record
EUVD-2018-2271
Updated
2026-11-03
GitHub AdvisoriesGHSA-54q2-pv96-8qc2 No score

lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect...

lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.

Record
GHSA-54q2-pv96-8qc2
Weakness
CWE-190
Updated
2026-11-02
OSVAZL-36960 7.1

CVE-2018-10195 affecting package lrzsz 0.12.20-50

lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.

Record
AZL-36960
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-05
OSVAZL-7285 7.1

CVE-2018-10195 affecting package lrzsz 0.12.20-50

lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.

Record
AZL-7285
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
Show 7 moreShow less
OSV 7.1

lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.

Record
CVE-2018-10195
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-10195 7.1

lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.

Record
DEBIAN-CVE-2018-10195
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-10195 7.1

lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.

Record
UBUNTU-CVE-2018-10195
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVMGASA-2022-0049 No score

Updated lrzsz packages fix security vulnerability

lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around. (CVE-2018-10195)

Record
MGASA-2022-0049
Updated
2026-11-02
OSVopenSUSE-SU-2024:11363-1 No score

rzsz-0.12.21~rc-4.5 on GA media

These are all security issues fixed in the rzsz-0.12.21~rc-4.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11363-1
Updated
2026-11-02
OSVSUSE-SU-2018:1066-1 No score

Security update for rzsz

This update for rzsz fixes the following issues:

  • Update to 0.12.21~rc to fix bsc#1086416 and bsc#1090051

  • CVE-2018-10195: segmentation fault in zsdata function could lead to denial of service (bsc#1090051)

Record
SUSE-SU-2018:1066-1
Updated
2026-11-02
OSVSUSE-SU-2018:1070-1 No score

Security update for rzsz

This update for rzsz fixes the following issues:

  • L3: sz of rzsz segfaults in zsdata() (bsc#1086416)
  • VUL-0: CVE-2018-10195: rzsz: sz can leak data to receiving side (bsc#1090051)
  • rzsz-0.12.20-976.7: illegal use of freed variable (bsc#529899)
  • /usr/bin/lsb segfaults [rzsz] (bsc#1076576)
Record
SUSE-SU-2018:1070-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
lrzsz
Azure Linux:3
 through 0.12.20-50 None known
lrzsz
Azure Linux:2
 through 0.12.20-50 None known
lrzsz
Debian:12
 before 0.12.21-10
0.12.21-10
lrzsz
Debian:13
 before 0.12.21-10
0.12.21-10
lrzsz
Debian:14
 before 0.12.21-10
0.12.21-10
lrzsz
Debian:9
 before 0.12.21-8+deb9u1, plus listed versions
0.12.21-8
0.12.21-8+deb9u1
lrzsz
Mageia:8
 before 0.12.21-23.1.mga8
0.12.21-23.1.mga8
rzsz
SUSE:Linux Enterprise Desktop 12 SP3
 before 0.12.21~rc-1001.3.1
0.12.21~rc-1001.3.1
rzsz
SUSE:Linux Enterprise Server 12 SP3
 before 0.12.21~rc-1001.3.1
0.12.21~rc-1001.3.1
rzsz
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 0.12.21~rc-1001.3.1
0.12.21~rc-1001.3.1
Show 6 moreShow less
Affected packages
PackageAffectedFixed
rzsz
SUSE:Linux Enterprise Server 11 SP4
 before 0.12.21~rc-936.3.1
0.12.21~rc-936.3.1
rzsz
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 0.12.21~rc-936.3.1
0.12.21~rc-936.3.1
lrzsz
Ubuntu:14.04:LTS
 before 0.12.21-10~build0.14.04.1, plus listed versions
0.12.21-50.12.21-7
0.12.21-10~build0.14.04.1
lrzsz
Ubuntu:16.04:LTS
 before 0.12.21-10~build0.16.04.1, plus listed versions
0.12.21-8
0.12.21-10~build0.16.04.1
lrzsz
Ubuntu:18.04:LTS
 before 0.12.21-10~build0.18.04.1, plus listed versions
0.12.21-80.12.21-8build1
0.12.21-10~build0.18.04.1
rzsz
openSUSE:Tumbleweed
 before 0.12.21~rc-4.5
0.12.21~rc-4.5

History

History
RecordedChangedSources
factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-10195 is a high vulnerability (CVSS 7.1) in Lrzsz Project Lrzsz, published April 24, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in lrzsz 0.12.21-10.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open