CVE-2011-1097
rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows...
CVE-2011-1097 is a medium vulnerability (CVSS 5.1) in Samba Rsync, published March 30, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.16%, the 88th percentile. Fixed in rsync 3.0.8.
- Severity
- 5.1 MediumCVSS 2.0, NVD
- Exploit chance
- 3.16%EPSS, 88th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.0.8rsync +11 more
Description
rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows remote rsync servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via malformed data.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rsyncDebian:12 | before 3.0.8 | 3.0.8 |
rsyncDebian:13 | before 3.0.8 | 3.0.8 |
rsyncDebian:14 | before 3.0.8 | 3.0.8 |
rsyncRed Hat:enterprise_linux:6::client | before 0:3.0.6-5.el6_0.1 | 0:3.0.6-5.el6_0.1 |
rsync-debuginfoRed Hat:enterprise_linux:6::client | before 0:3.0.6-5.el6_0.1 | 0:3.0.6-5.el6_0.1 |
rsyncRed Hat:enterprise_linux:6::computenode | before 0:3.0.6-5.el6_0.1 | 0:3.0.6-5.el6_0.1 |
rsync-debuginfoRed Hat:enterprise_linux:6::computenode | before 0:3.0.6-5.el6_0.1 | 0:3.0.6-5.el6_0.1 |
rsyncRed Hat:enterprise_linux:6::server | before 0:3.0.6-5.el6_0.1 | 0:3.0.6-5.el6_0.1 |
rsync-debuginfoRed Hat:enterprise_linux:6::server | before 0:3.0.6-5.el6_0.1 | 0:3.0.6-5.el6_0.1 |
rsyncRed Hat:enterprise_linux:6::workstation | before 0:3.0.6-5.el6_0.1 | 0:3.0.6-5.el6_0.1 |
rsync-debuginfoRed Hat:enterprise_linux:6::workstation | before 0:3.0.6-5.el6_0.1 | 0:3.0.6-5.el6_0.1 |
rsyncopenSUSE:Tumbleweed From an advisory covering 4 CVEs | before 3.1.2-1.5 | 3.1.2-1.5 |
What each source reports
NVD Score used
rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows remote rsync servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via malformed data.
- Record
CVE-2011-1097- CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows remote rsync servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via malformed data.
- Record
CVE-2011-1097- Updated
- 2026-11-02
EUVDEUVD-2011-1111No score
rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows remote rsync servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via malformed data.
- Record
EUVD-2011-1111- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rp4c-gxm3-wmf6No score
rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows...
rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows remote rsync servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via malformed data.
- Record
GHSA-rp4c-gxm3-wmf6- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVNo score
rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows remote rsync servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via malformed data.
- Record
CVE-2011-1097- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-1097No score
rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows remote rsync servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via malformed data.
- Record
DEBIAN-CVE-2011-1097- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10548-1No score
rsync-3.1.2-1.5 on GA media
These are all security issues fixed in the rsync-3.1.2-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10548-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/44088
lists.fedoraproject.org/pipermail/package-announce/2011-April/057737.html
marc.info?l=bugtraq&m=133226187115472&w=2
lists.samba.org/archive/rsync/2011-January/025988.html
lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
redhat.com/support/errata/RHSA-2011-0390.html
Show 26 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=675036
mandriva.com/security/advisories?name=MDVSA-2011:066
vupen.com/english/advisories/2011/0793
bugzilla.samba.org/show_bug.cgi?id=7936
rsync.samba.org/ftp/rsync/src/rsync-3.0.8-NEWS
gitweb.samba.org?p=rsync.git%3Ba=commit%3Bh=83b94efa6b60a3ff5eee4c5f7812c617a90a03f6
securitytracker.com/id?1025256
nvd.nist.gov/vuln/detail/CVE-2011-1097
github.com/advisories/GHSA-rp4c-gxm3-wmf6
security-tracker.debian.org/tracker/CVE-2011-1097
access.redhat.com/errata/RHSA-2011:0390
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0390.json
cve.org/CVERecord?id=CVE-2011-1097
suse.com/security/cve/CVE-2011-1097