An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected.

🗓️ 04 Feb 2023 08:00:00Reported by MicrosoftType

Integer overflow in the syslog-ng RFC3164 parser (3.0–3.37) enables remote denial of service.

Reporter	Title	Published	Views	Family All 59
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	15 Apr 202503:04	–	ibm
AlpineLinux	CVE-2022-38725	23 Jan 202300:00	–	alpinelinux
AstraLinux	Astra Linux – Vulnerability in syslog-ng	20 May 202605:53	–	astralinux
BDU FSTEC	The vulnerability of the RFC3164 analyzer in the Syslog-ng logging processing tool allows a attacker to trigger a service failure.	26 Dec 202300:00	–	bdu_fstec
Broadcom	An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service	13 Jun 202300:00	–	broadcom
CBLMariner	CVE-2022-38725 affecting package syslog-ng 3.23.1-3	2 Mar 202304:18	–	cbl_mariner
CBLMariner	CVE-2022-38725 affecting package syslog-ng for versions less than 3.33.2-7	5 Dec 202304:40	–	cbl_mariner
CBLMariner	CVE-2022-38725 affecting package syslog-ng for versions less than 4.3.1-2	5 Feb 202522:13	–	cbl_mariner
CNNVD	syslog-ng 输入验证错误漏洞	29 Aug 202200:00	–	cnnvd
CVE	CVE-2022-38725	23 Jan 202300:00	–	cve