Package        : rsync
Version        : 3.1.1-3+deb8u2
CVE ID         : CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843
                  CVE-2018-5764


Trail of Bits used the automated vulnerability discovery tools developed 
for the DARPA Cyber Grand Challenge to audit zlib. As rsync, a fast, 
versatile, remote (and local) file-copying tool, uses an embedded copy of 
zlib, those issues are also present in rsync.


CVE-2016-9840
      In order to avoid undefined behavior, remove offset pointer
      optimization, as this is not compliant with the C standard.

CVE-2016-9841
      Only use post-increment to be compliant with the C standard.

CVE-2016-9842
      In order to avoid undefined behavior, do not shift negative values,
      as this is not compliant with the C standard.

CVE-2016-9843
      In order to avoid undefined behavior, do not pre-decrement a pointer
      in big-endian CRC calculation, as this is not compliant with the
      C standard.

CVE-2018-5764
      Prevent remote attackers from being able to bypass the
      argument-sanitization protection mechanism by ignoring --protect-args
      when already sent by client.


For Debian 8 "Jessie", these problems have been fixed in version
3.1.1-3+deb8u2.

We recommend that you upgrade your rsync packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS