CVE-2024-22857

Heap based buffer flow in zlog v1.1.0 to v1.2.17 in zlogrulenew.The size of recordname is MAXLENPATH1024 + 1 but filepath may have data upto MAXLENCFGLINEMAXLENPATH4 + 1. So a check was missing in zlogrulenew while copying the recordname from filepath + 1 which caused the buffer overflow. An...

OESA-2024-2318 zlog security update

zlog is a reliable, high-performance, thread safe, flexible, clear-model, pure C logging library. Security Fixes: Heap based buffer flow in zlog v1.1.0 to v1.2.17 in zlogrulenew.The size of recordname is MAXLENPATH1024 + 1 but filepath may have data upto MAXLENCFGLINEMAXLENPATH4 + 1. So a check w...

OESA-2024-2213 zlog security update

zlog is a reliable, high-performance, thread safe, flexible, clear-model, pure C logging library. Security Fixes: Heap based buffer flow in zlog v1.1.0 to v1.2.17 in zlogrulenew.The size of recordname is MAXLENPATH1024 + 1 but filepath may have data upto MAXLENCFGLINEMAXLENPATH4 + 1. So a check w...

CVE-2024-22857

creationtimestamp| type| source ---|---|--- 2024-03-07 02:26:59+00:00| seen| https://t.me/ctinow/202000 2024-03-13 15:53:39+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/10140 2024-03-15 01:31:50+00:00| seen| https://t.me/ctinow/208329...

CVE-2024-22857

The zlog C logging library (versions v1.1.0 to v1.2.17 ) contains a heap-based buffer overflow in the zlog_rule_new() function. The root cause is a missing bounds check when copying record_name from file_path + 1; while record_name is allocated with a size of MAXLEN_PATH(1024) + 1 , the file_path...