Integer overflow in the rsCStrExtendBuf function in runtime/stringbuf.c in the imfile module in rsyslog 4.x before 4.6.6, 5.x before 5.7.4, and 6.x before 6.1.4 allows local users to cause a denial of service (daemon hang) via a large file, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 3.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rsyslog-mysqlUpgrade rsyslog-snmpUpgrade rsyslogUpgrade rsyslog-gssapiUpgrade rsyslog-pgsqlUpgrade rsyslog-gnutlsUpgrade rsyslog-relp | Dec 1, 2016 | Sep 25, 2012 |
| Debian | — | Upgrade rsyslog | Jul 30, 2024 | Sep 25, 2012 |
| Gentoo Linux | — | Upgrade app-admin/rsyslog. | Oct 30, 2017 | Sep 25, 2012 |
| Oracle_linux | — | Upgrade rsyslog-gnutlsUpgrade rsyslog-snmpUpgrade rsyslogUpgrade rsyslog-mysqlUpgrade rsyslog-gssapiUpgrade rsyslog-pgsqlUpgrade rsyslog-relp | Oct 16, 2024 | Sep 25, 2012 |
| Ubuntu | — | Upgrade rsyslog | Nov 8, 2024 | Sep 25, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub