Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - lrzsz 之前 0.13.0 包含 lrz 接收公用程式限制模式中的路徑遊走弱點，允許惡意 ZMODEM 傳送端使用絕對路徑名稱在目前目錄之外寫入檔案。因為 src/lrz.c 中的 checkpath（） 只拒絕「../' 序列，除非以 建置， --enable-pubdir否則攻擊者可以傳送以絕對路徑命名的檔案，以覆寫接收使用者可寫入的任何檔案。（CVE-2026-105840）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - lrzsz 之前 0.13.0 在 lrz 接收实用工具的受限模式下包含一个路径遍历漏洞，可允许恶意 ZMODEM 发送者使用绝对路径名在当前目录外部写入文件。因为 src/lrz.c 中的 checkpath（） 仅拒绝“..除非使用 /' 序列构建 --enable-pubdir，否则攻击者可以发送以绝对路径命名的文件，以覆盖接收用户可写入的任何文件。（CVE-2026-105840）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 0.13.0 より前の lrzsz には、lrz 受信ユーティリティの制限モードにパストラバーサルの脆弱性があるため、悪意のある ZMODEM 送信者が絶対パス名を使用して現在のディレクトリの外側にファイルを書き込む可能性があります。src/lrz.c の checkpath() は「...」のみを拒否するためです。 --enable-pubdir で構築されていない限り、攻撃者は絶対パスで名前が付けられたファイルを送信して、受信側ユーザーが書き込み可能なファイルを上書きする可能性があります。(CVE-2026-105840)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:83525 advisory.

    * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)
      * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)


    Bug Fix(es) and Enhancement(s):

      * lrzsz: segfault with -s [almalinux-8.10.z] (JIRA:AlmaLinux-282148)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:83525 advisory.

    * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)

    * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)

    Bug Fix(es) and Enhancement(s):

    * lrzsz: segfault with -s [rhel-8.10.z] (JIRA:Rocky Linux-282148)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode     that allows malicious ZMODEM senders to write files outside the current directory using absolute     pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-     pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving     user. (CVE-2026-105840)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-83525 advisory.

    - Backport tightened path handling from 0.13.1 (CVE-2026-105840)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792053113 advisory.

  - lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode     that allows malicious ZMODEM senders to write files outside the current directory using absolute     pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-     pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving     user. (CVE-2026-105840)

  - lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode     that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a     suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to     popen(), so shell metacharacters execute as the receiving user. (CVE-2026-105841)

  - lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive     utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply     filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap     memory and crash lrz. (CVE-2026-105842)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:83525 advisory.

    Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the     public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem     solution for Linux systems.

    Security Fix(es):

    * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)

    * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)

    Bug Fix(es) and Enhancement(s):

    * lrzsz: segfault with -s [rhel-8.10.z] (JIRA:RHEL-282148)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2077:01 advisory.

    * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)
      * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)     Bug Fix(es) and Enhancement(s):
      * lrzsz: segfault with -s [rhel-8.10.z] (JIRA:RHEL-282148)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
363476	Linux Distros 未修補弱點：CVE-2026-105840	Nessus	Misc.	2026/10/7	2026/10/9	high
363476	Linux Distros 未修补的漏洞：CVE-2026-105840	Nessus	Misc.	2026/10/7	2026/10/9	high
363476	Linux Distros のパッチ未適用の脆弱性: CVE-2026-105840	Nessus	Misc.	2026/10/7	2026/10/9	high
366106	AlmaLinux 8 : lrzsz (ALSA-2026:83525)	Nessus	Alma Linux Local Security Checks	2026/10/15	2026/10/15	high
366493	RockyLinux 8 : lrzsz (RLSA-2026:83525)	Nessus	Rocky Linux Local Security Checks	2026/10/16	2026/10/16	high
363476	Linux Distros Unpatched Vulnerability : CVE-2026-105840	Nessus	Misc.	2026/10/7	2026/10/9	high
366314	Oracle Linux 8 : lrzsz (ELSA-2026-83525)	Nessus	Oracle Linux Local Security Checks	2026/10/15	2026/10/15	high
366112	AlmaLinux 9.2 [TuxCare] Security Update: lrzsz Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792053113)	Nessus	Alma Linux Local Security Checks	2026/10/15	2026/10/15	high
366117	RHEL 8 : lrzsz (RHSA-2026:83525)	Nessus	Red Hat Local Security Checks	2026/10/15	2026/10/15	high
366455	MiracleLinux 8 : lrzsz-0.12.20-46.el8_10 (AXSA:2026-2077:01)	Nessus	Miracle Linux Local Security Checks	2026/10/16	2026/10/16	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high