CVE-2008-5110

syslog-ng does not call chdir when it calls chroot, which might allow attackers to escape the intended jail. NOTE: this is only a vulnerability when a separate vulnerability is present. This flaw affects syslog-ng versions prior to and including 2.0.9...

syslog-ng2 -- startup directory leakage in the chroot environment

Florian Grandel reports: I have not had the time to analyze all of syslog-ng code. But by reading the code section near the chroot call and looking at strace results I believe that syslog-ng does not chdir to the chroot jail's location before chrooting into it. This opens up ways to work around t...

Gentoo Security Advisory GLSA 200712-19 (syslog-ng)

The remote host is missing updates announced in advisory GLSA 200712-19. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gentoo Security Advisory GLSA 200712-19 (syslog-ng)

The remote host is missing updates announced in advisory GLSA 200712-19. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Debian Security Advisory DSA 1464-1 (syslog-ng)

The remote host is missing an update to syslog-ng announced via advisory DSA 1464-1. OpenVAS Vulnerability Test $Id: deb14641.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1464-1 syslog-ng Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Debian: Security Advisory (DSA-1464-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 7 : syslog-ng-2.0.7-1.fc7 (2008-0559)

Contains a security fix for CVE-2007-6437/ZSA-2007-029 DoS Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Fedora 8 : syslog-ng-2.0.7-1.fc8 (2008-0523)

Contains a security fix for CVE-2007-6437/ZSA-2007-029 DoS Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

[SECURITY] Fedora 7 Update: syslog-ng-2.0.7-1.fc7

syslog-ng, as the name shows, is a syslogd replacement, but with new functionality for the new generation. The original syslogd allows messages only to be sorted based on priority/facility pairs; syslog-ng adds the possibility to filter based on message contents using regular expressions. The new...

[SECURITY] Fedora 8 Update: syslog-ng-2.0.7-1.fc8

syslog-ng, as the name shows, is a syslogd replacement, but with new functionality for the new generation. The original syslogd allows messages only to be sorted based on priority/facility pairs; syslog-ng adds the possibility to filter based on message contents using regular expressions. The new...

Debian: Security Advisory (DSA-175)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 175-1 (syslog-ng)

The remote host is missing an update to syslog-ng announced via advisory DSA 175-1. OpenVAS Vulnerability Test $Id: deb1751.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 175-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian DSA-1464-1 : syslog-ng - NULL pointer dereference

Oriol Carreras discovered that syslog-ng, a next generation logging daemon can be tricked into dereferencing a NULL pointer through malformed timestamps, which can lead to denial of service and the disguise of an subsequent attack, which would otherwise be logged. %NASLMINLEVEL 70300 C Tenable...

[SECURITY] [DSA 1464-1] New syslog-ng packages fix denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA-1464-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 15, 2008 http://www.debian.org/security/faq -...

DSA-1464-1 syslog-ng - denial of service

Bulletin has no description...

GLSA-200712-19 : Syslog-ng: Denial of Service

The remote host is affected by the vulnerability described in GLSA-200712-19 Syslog-ng: Denial of Service Oriol Carreras reported a NULL pointer dereference in the logmsgparse function when processing timestamps without a terminating whitespace character. Impact : A remote attacker could send a...

Syslog-ng: Denial of service

Background Syslog-ng is a flexible and scalable system logger. Description Oriol Carreras reported a NULL pointer dereference in the logmsgparse function when processing timestamps without a terminating whitespace character. Impact A remote attacker could send a specially crafted event to a...

DTSA-105-1 syslog-ng - remote denial of service

Bulletin has no description...

CVE-2007-6437

Balabit syslog-ng 2.0.x before 2.0.6 and 2.1.x before 2.1.8 allows remote attackers to cause a denial of service crash via a message with a timestamp that does not contain a trailing space, which triggers a NULL pointer dereference...

CVE-2007-6437

Balabit syslog-ng 2.0.x before 2.0.6 and 2.1.x before 2.1.8 allows remote attackers to cause a denial of service crash via a message with a timestamp that does not contain a trailing space, which triggers a NULL pointer dereference...