K42903299 : rsyslog: remote syslog PRI vulnerability CVE-2014-3634

Security Advisory Description

rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash), possibly execute arbitrary code, or have other unspecified impact via a crafted priority (PRI) value that triggers an out-of-bounds array access. (CVE-2014-3634)
Impact
In certain configurations, a local attacker or a remote attacker that can connect to the rsyslogport could use this flaw to make the rsyslogdaemon no longer respond or, potentially in rsyslog 7.x, run arbitrary code as the user that is running the rsyslogdaemon.