CVE-2016-3634

CVE-2016-3634 affects LibTIFF up to version 4.0.6. The vulnerability exists in the tagCompare function in tif_dirinfo.c used by the thumbnail tool, causing an out-of-bounds read and potential crash (denial of service). Remediation per connected advisories is to upgrade to LibTIFF 4.0.7 or newer.

CVE-2016-3634

The tagCompare function in tifdirinfo.c in the thumbnail tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service out-of-bounds read via vectors related to fieldtag matching...

CVE-2007-3635

Multiple unspecified vulnerabilities in the G/PGP GPG Plugin before 2.1 for Squirrelmail might allow "local authenticated users" to inject certain commands via unspecified vectors. NOTE: this might overlap CVE-2005-1924, CVE-2006-4169, or CVE-2007-3634...

Oracle: Security Advisory (ELSA-2014-1671)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle: Security Advisory (ELSA-2014-1654)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle: Security Advisory (ELSA-2014-1397)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux: Security Advisory (ALAS-2014-445)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED12 / SLES12 Security Update : update for rsyslog (SUSE-SU-2014:1438-1)

This update for rsyslog provides the following fixes : - Fixed remote PRI DoS vulnerability patch CVE-2014-3683, bnc899756 - Removed broken, unsupported and dropped by upstream zpipe utility from rsyslog-diag-tools package bnc890228 Note that Tenable Network Security has extracted the preceding...

Mandriva Linux Security Advisory : rsyslog (MDVSA-2015:130)

Updated rsyslog packages fix security vulnerability : Rainer Gerhards, the rsyslog project leader, reported a vulnerability in Rsyslog. As a consequence of this vulnerability an attacker can send malformed messages to a server, if this one accepts data from untrusted sources, and trigger a denial...

AIX rsyslog Advisory : rsyslog_advisory.asc

The version of rsyslog installed on the remote AIX host is affected by a remote code execution or denial of service vulnerability : - The installed rsyslog allows remote attackers to cause a denial of service crash, possibly execute arbitrary code, or have other unspecified impacts by crafting a...

OracleVM 3.3 : rsyslog (OVMSA-2014-0030)

The remote OracleVM system is missing necessary patches to address critical security updates : - use setsid to get a controlling session and process group Orabug: 17346261 Todd Vierling - fix CVE-2014-3634 resolves: 1149148 - drop patch 5 which introduced a regression resolves: 927405 reverts:...

Amazon Linux AMI : rsyslog (ALAS-2014-445)

A flaw was found in the way rsyslog handled invalid log message priority values. In certain configurations, a local attacker, or a remote attacker able to connect to the rsyslog port, could use this flaw to crash the rsyslog daemon. CVE-2014-3634 C Tenable Network Security, Inc. The descriptive...

CentOS 6 : rsyslog7 (CESA-2014:1654)

Updated rsyslog7 packages that fix one security issue are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

Medium: rsyslog

Issue Overview: A flaw was found in the way rsyslog handled invalid log message priority values. In certain configurations, a local attacker, or a remote attacker able to connect to the rsyslog port, could use this flaw to crash the rsyslog daemon. CVE-2014-3634 Affected Packages: rsyslog Issue...

Fedora 21 : sysklogd-1.5-18.fc21 (2014-12875)

Added patch for remote syslog PRI vulnerability 1142373 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

CVE-2014-3634

rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service crash, possibly execute arbitrary code, or have other unspecified impact via a crafted priority PRI value that triggers an out-of-bounds array access...

CVE-2014-3634

rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service crash, possibly execute arbitrary code, or have other unspecified impact via a crafted priority PRI value that triggers an out-of-bounds array access...

Integer overflow

Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service crash via a large priority PRI value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634...

CVE-2014-3683

CVE-2014-3683 is an rsyslog-related integer overflow vulnerability: rsyslog before 7.6.7 and 8.x before 8.4.2 (and sysklogd 1.5 and earlier) can crash the daemon when processing a crafted high PRI value, enabling a remote DoS. The issue stems from an incomplete fix for CVE-2014-3634. Public advis...

CVE-2014-3634

CVE-2014-3634 and CVE-2014-3683 affect rsyslog (and sysklogd prior to 1.5). A crafted PRI value can trigger out-of-bounds/heap-based access, leading to denial of service and potentially remote code execution. In practice, rsyslog versions affected include 7.x before 7.6.7 and 8.x before 8.4.2 (an...