{"id":"CVE-2018-10195","aliases":["AZL-36960","AZL-7285","DEBIAN-CVE-2018-10195","DLA-2900-1","EUVD-2018-2271","GHSA-54q2-pv96-8qc2","MGASA-2022-0049","SUSE-SU-2018:1066-1","SUSE-SU-2018:1070-1","UBUNTU-CVE-2018-10195","openSUSE-SU-2024:11363-1"],"status":"published","title":"lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect...","description":"lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00391,"percentile":0.33434,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2018-04-24T11:14:38Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:12","package":"lrzsz","fixed_in":["0.12.21-10"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lrzsz","fixed_in":["0.12.21-10"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lrzsz","fixed_in":["0.12.21-10"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"lrzsz","fixed_in":["0.12.21-8+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"lrzsz","fixed_in":["0.12.21-23.1.mga8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"rzsz","fixed_in":["0.12.21~rc-1001.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"rzsz","fixed_in":["0.12.21~rc-1001.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"rzsz","fixed_in":["0.12.21~rc-1001.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"rzsz","fixed_in":["0.12.21~rc-936.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"rzsz","fixed_in":["0.12.21~rc-936.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"lrzsz","fixed_in":["0.12.21-10~build0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"lrzsz","fixed_in":["0.12.21-10~build0.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"lrzsz","fixed_in":["0.12.21-10~build0.18.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rzsz","fixed_in":["0.12.21~rc-4.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.12.20-50"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.12.20-50"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21-10"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21-10"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21-10"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21-8+deb9u1"}]}],"versions":["0.12.21-8"]},{"source":"osv","ecosystem":"Mageia:8","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21-23.1.mga8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"rzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21~rc-1001.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"rzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21~rc-1001.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"rzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21~rc-1001.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"rzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21~rc-936.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"rzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21~rc-936.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21-10~build0.14.04.1"}]}],"versions":["0.12.21-5","0.12.21-7"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21-10~build0.16.04.1"}]}],"versions":["0.12.21-8"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21-10~build0.18.04.1"}]}],"versions":["0.12.21-8","0.12.21-8build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21~rc-4.5"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"lrzsz_project","product":"lrzsz"},{"vendor":"suse","product":"linux_enterprise_debuginfo"},{"vendor":"suse","product":"linux_enterprise_desktop"},{"vendor":"suse","product":"linux_enterprise_server"}],"references":[{"url":"http://www.ohse.de/uwe/software/lrzsz.html","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2018-April/003955.html?_ga=2.81625751.1026327980.1622040648-1950393542.1547130931","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2018-April/003956.html?_ga=2.81625751.1026327980.1622040648-1950393542.1547130931","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1572058","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00027.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Issue Tracking","Mailing List","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10195","tags":["web"]},{"url":"https://github.com/advisories/GHSA-54q2-pv96-8qc2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-10195","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0049.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29970","tags":["report"]},{"url":"https://www.debian.org/lts/security/2022/dla-2900","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181066-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1076576","tags":["report"]},{"url":"https://bugzilla.suse.com/1086416","tags":["report"]},{"url":"https://bugzilla.suse.com/1090051","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10195","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181070-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/529899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10195","tags":["report"]},{"url":"https://bugzilla.novell.com/show_bug.cgi?id=1090051","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-10195","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-10195","description":"lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.","status":"published","published":"2021-06-02T13:54:18Z","modified":"2024-08-05T07:32:01.629Z","updated_at":"2026-11-02T14:35:01.619448Z"}],"euvd":[{"id":"EUVD-2018-2271","description":"lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.","status":"published","published":"2021-06-02T13:54:18Z","modified":"2024-08-05T07:32:01Z","updated_at":"2026-11-03T02:39:58.981487Z"}],"ghsa":[{"id":"GHSA-54q2-pv96-8qc2","title":"lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect...","description":"lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.","status":"published","published":"2022-05-24T19:03:54Z","modified":"2023-01-29T05:06:50Z","cwes":["CWE-190"],"updated_at":"2026-11-02T14:46:06.412268Z"}],"nvd":[{"id":"CVE-2018-10195","description":"lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.","status":"published","published":"2021-06-02T14:15:07.817Z","modified":"2026-06-17T01:33:39.563Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":3.6,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:05:00.565712Z"}],"osv":[{"id":"AZL-36960","title":"CVE-2018-10195 affecting package lrzsz 0.12.20-50","description":"lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.","status":"published","published":"2021-06-02T14:15:07Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"AZL-7285","title":"CVE-2018-10195 affecting package lrzsz 0.12.20-50","description":"lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.","status":"published","published":"2021-06-02T14:15:07Z","modified":"2026-04-21T04:33:43.405515Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"CVE-2018-10195","description":"lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.","status":"published","published":"2021-06-02T14:15:07.817Z","modified":"2026-04-16T04:34:28.432358222Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-10195","description":"lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.","status":"published","published":"2021-06-02T14:15:07.817Z","modified":"2026-10-23T18:03:18.529611341Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"UBUNTU-CVE-2018-10195","description":"lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.","status":"published","published":"2021-06-02T14:15:00Z","modified":"2025-07-16T08:13:40.112037Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"DLA-2900-1","title":"lrzsz - security update","status":"published","published":"2022-01-25T00:00:00Z","modified":"2026-03-09T01:22:53.223965Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2022-0049","title":"Updated lrzsz packages fix security vulnerability","description":"lrzsz before version 0.12.21~rc can leak information to the receiving side\ndue to an incorrect length check in the function zsdata that causes a\nsize_t to wrap around. (CVE-2018-10195)\n","status":"published","published":"2022-02-05T20:23:13Z","modified":"2026-04-16T04:44:40.591237824Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:11363-1","title":"rzsz-0.12.21~rc-4.5 on GA media","description":"These are all security issues fixed in the rzsz-0.12.21~rc-4.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:32:25.900225Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:1066-1","title":"Security update for rzsz","description":"This update for rzsz fixes the following issues:\n\n- Update to 0.12.21~rc to fix bsc#1086416 and bsc#1090051 \n\n- CVE-2018-10195: segmentation fault in zsdata function could lead to denial of service (bsc#1090051)\n\n ","status":"published","published":"2018-04-24T11:14:38Z","modified":"2026-02-04T03:03:53.975001Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:1070-1","title":"Security update for rzsz","description":"This update for rzsz fixes the following issues:\n\n- L3: sz of rzsz segfaults in zsdata() (bsc#1086416)\n- VUL-0: CVE-2018-10195: rzsz: sz can leak data to receiving side (bsc#1090051)\n- rzsz-0.12.20-976.7: illegal use of freed variable (bsc#529899)\n- /usr/bin/lsb segfaults [rzsz] (bsc#1076576)\n\n\n","status":"published","published":"2018-04-24T11:15:23Z","modified":"2026-02-04T04:22:27.091082Z","updated_at":"2026-11-02T15:53:44.594517Z"}]}}