Lucene search
GoogleOSV:DLA-72-2HistoryOct 19, 2014 - 12:00 a.m.
rsyslog - regression update
2014-10-1900:00:00
Google
osv.dev
7
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
The Wheezy patch left an unresolved symbol in the imklog module of
the Squeeze version. rsyslog worked fine except that messages from the
kernel couldn’t be submitted any longer. This update fixes this issue.
For reference, the original advisory text follows.
- CVE-2014-3634
Fix remote syslog vulnerability due to improper handling
of invalid PRI values. - CVE-2014-3683
Followup fix for CVE-2014-3634. The initial patch was incomplete.
It did not cover cases where PRI values > MAX_INT caused integer
overflows resulting in negative values.
For Debian 6 Squeeze, these issues have been fixed in rsyslog version 4.6.4-2+deb6u2
References
Related
nessus
nessus
Debian DSA-3047-1 : rsyslog - security update
2014-10-09 00:00:00
AIX rsyslog Advisory : rsyslog_advisory.asc
2014-12-02 00:00:00
openSUSE Security Update : rsyslog (openSUSE-SU-2014:1297-1)
2014-10-16 00:00:00
aix
aix
Open Source RSyslog vulnerability
2014-11-14 15:31:13
suse
suse
Security update for rsyslog (important)
2014-10-15 00:04:46
securityvulns
securityvulns
rsyslog DoS
2014-10-05 00:00:00
[SECURITY] [DSA 3040-1] rsyslog security update
2014-10-05 00:00:00
debiancve
debiancve
CVE-2014-3683
2014-11-02 00:55:00
CVE-2014-3634
2014-11-02 00:55:00
openvas
openvas
Debian: Security Advisory (DSA-3047-1)
2014-10-07 00:00:00
Debian Security Advisory DSA 3047-1 (rsyslog - security update)
2014-10-08 00:00:00
SUSE: Security Advisory for rsyslog (SUSE-SU-2014:1294-1)
2015-10-13 00:00:00
ibm
ibm
cve
cve
ubuntucve
ubuntucve
CVE-2014-3634
2014-10-01 00:00:00
CVE-2014-3683
2014-10-02 00:00:00
osv
osv
rsyslog - security update
2014-10-19 00:00:00
rsyslog - security update
2014-10-08 00:00:00
rsyslog - security update
2014-09-30 00:00:00
debian
debian
[SECURITY] [DLA 72-1] rsylog security update
2014-10-19 17:00:31
[SECURITY] [DSA 3047-1] rsyslog security update
2014-10-08 11:12:07
[SECURITY] [DSA 3040-1] rsyslog security update
2014-09-30 21:14:26
prion
prion
Integer overflow
2014-11-02 00:55:00
Out-of-bounds
2014-11-02 00:55:00
Design/Logic Flaw
2014-10-13 18:55:00
altlinux
altlinux
Security fix for the ALT Linux 7 package rsyslog version 7.6.7-alt0.M70P.1
2014-10-13 00:00:00
ubuntu
ubuntu
Rsyslog vulnerabilities
2014-10-09 00:00:00
cvelist
cvelist
CVE-2014-3683
2014-11-02 00:00:00
CVE-2014-3634
2014-11-02 00:00:00
gentoo
gentoo
RSYSLOG: Denial of service
2014-12-24 00:00:00
checkpoint_advisories
checkpoint_advisories
RSYSLOG PRI Value Parsing Integer Overflow Denial of Service (CVE-2014-3683)
2014-12-02 00:00:00
archlinux
archlinux
rsyslog: remote denial of service
2014-10-08 00:00:00
rsyslog: remote denial of service
2014-10-01 00:00:00
f5
f5
K42903299 : rsyslog: remote syslog PRI vulnerability CVE-2014-3634
2017-07-06 00:00:00
freebsd
freebsd
rsyslog -- remote syslog PRI vulnerability
2014-09-30 00:00:00
mageia
mageia
Updated rsyslog packages fix CVE-2014-3634
2014-10-09 18:39:32
fedora
fedora
[SECURITY] Fedora 19 Update: sysklogd-1.5-18.fc19
2014-10-27 03:28:59
[SECURITY] Fedora 20 Update: rsyslog-7.4.8-2.fc20
2014-10-16 02:02:22
[SECURITY] Fedora 20 Update: sysklogd-1.5-18.fc20
2014-10-27 03:28:07
veracode
veracode
Remote Code Execution (RCE)
2019-01-15 09:02:37
redhat
redhat
(RHSA-2014:1397) Important: rsyslog security update
2014-10-13 00:00:00
(RHSA-2014:1654) Important: rsyslog7 security update
2014-10-16 00:00:00
(RHSA-2014:1671) Moderate: rsyslog5 and rsyslog security update
2014-10-20 00:00:00
oraclelinux
oraclelinux
rsyslog security update
2014-10-13 00:00:00
rsyslog5 and rsyslog security update
2014-10-20 00:00:00
rsyslog7 security update
2014-10-21 00:00:00
amazon
amazon
Medium: rsyslog
2014-11-11 10:26:00
Important: rsyslog
2022-05-31 23:50:00
Important: rsyslog
2022-05-31 23:47:00
centos
centos
rsyslog, rsyslog5 security update
2014-10-21 15:10:11
rsyslog security update
2014-10-13 19:45:27
rsyslog7 security update
2014-10-20 18:15:12
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related for OSV:DLA-72-2