CVE-2014-3634

rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash), possibly execute arbitrary code, or have other unspecified impact via a crafted priority (PRI) value that triggers an out-of-bounds array access.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 93%
Affected Products (NVD)
VendorProductVersion
sysklogd_projectsysklogd
𝑥
≤ 1.5
sysklogd_projectsysklogd
1.1
sysklogd_projectsysklogd
1.2
sysklogd_projectsysklogd
1.3
sysklogd_projectsysklogd
1.4
sysklogd_projectsysklogd
1.4.1
rsyslogrsyslog
𝑥
≤ 7.6.5
rsyslogrsyslog
8.1.0
rsyslogrsyslog
8.1.1
rsyslogrsyslog
8.1.2
rsyslogrsyslog
8.1.3
rsyslogrsyslog
8.1.4
rsyslogrsyslog
8.1.5
rsyslogrsyslog
8.1.6
rsyslogrsyslog
8.2.0
rsyslogrsyslog
8.2.1
rsyslogrsyslog
8.2.2
rsyslogrsyslog
8.2.3
rsyslogrsyslog
8.3.0
rsyslogrsyslog
8.3.1
rsyslogrsyslog
8.3.2
rsyslogrsyslog
8.3.3
rsyslogrsyslog
8.3.4
rsyslogrsyslog
8.3.5
rsyslogrsyslog
8.4.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
inetutils
bookworm
2:2.4-2+deb12u1
fixed
bullseye
2:2.0-1+deb11u2
fixed
sid
2:2.5-5
fixed
squeeze
no-dsa
trixie
2:2.5-5
fixed
wheezy
no-dsa
rsyslog
bookworm
8.2302.0-1
fixed
bullseye
8.2102.0-2+deb11u1
fixed
bullseye (security)
8.2102.0-2+deb11u1
fixed
sid
8.2410.0-1
fixed
squeeze
no-dsa
trixie
8.2410.0-1
fixed
wheezy
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
rsyslog
lucid
Fixed 4.2.0-2ubuntu8.3
released
precise
Fixed 5.8.6-1ubuntu8.9
released
trusty
Fixed 7.4.4-1ubuntu2.3
released
utopic
Fixed 7.4.4-1ubuntu11
released
vivid
Fixed 7.4.4-1ubuntu11
released
wily
Fixed 7.4.4-1ubuntu11
released
xenial
Fixed 7.4.4-1ubuntu11
released
yakkety
Fixed 7.4.4-1ubuntu11
released
zesty
Fixed 7.4.4-1ubuntu11
released
sysklogd
lucid
ignored
precise
ignored
trusty
dne
utopic
dne
vivid
dne
wily
dne
xenial
dne
yakkety
dne
zesty
dne
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
rsyslog
suse enterprise desktop 15
8.33.1-1.30
fixed
suse enterprise desktop 15 SP1
8.33.1-3.9.1
fixed
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise sap 15
8.33.1-1.30
fixed
suse enterprise sap 15 SP1
8.33.1-3.9.1
fixed
suse enterprise server 12 SP2
8.4.0-14.1
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 15
8.33.1-1.30
fixed
suse enterprise server 15 SP1
8.33.1-3.9.1
fixed
rsyslog-diag-tools
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 12 SP2
8.4.0-14.1
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
rsyslog-doc
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 12 SP2
8.4.0-14.1
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
rsyslog-module-gssapi
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise sap 15
8.33.1-1.30
fixed
suse enterprise sap 15 SP1
8.33.1-3.9.1
fixed
suse enterprise server 12 SP2
8.4.0-14.1
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 15
8.33.1-1.30
fixed
suse enterprise server 15 SP1
8.33.1-3.9.1
fixed
rsyslog-module-gtls
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise sap 15 SP1
8.33.1-3.9.1
fixed
suse enterprise server 12 SP2
8.4.0-14.1
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 15 SP1
8.33.1-3.9.1
fixed
rsyslog-module-mmnormalize
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
rsyslog-module-mysql
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise sap 15
8.33.1-1.30
fixed
suse enterprise sap 15 SP1
8.33.1-3.9.1
fixed
suse enterprise server 12 SP2
8.4.0-14.1
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 15
8.33.1-1.30
fixed
suse enterprise server 15 SP1
8.33.1-3.9.1
fixed
rsyslog-module-pgsql
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise sap 15
8.33.1-1.30
fixed
suse enterprise sap 15 SP1
8.33.1-3.9.1
fixed
suse enterprise server 12 SP2
8.4.0-14.1
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 15
8.33.1-1.30
fixed
suse enterprise server 15 SP1
8.33.1-3.9.1
fixed
rsyslog-module-relp
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise sap 15
8.33.1-1.30
fixed
suse enterprise sap 15 SP1
8.33.1-3.9.1
fixed
suse enterprise server 12 SP2
8.4.0-14.1
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 15
8.33.1-1.30
fixed
suse enterprise server 15 SP1
8.33.1-3.9.1
fixed
rsyslog-module-snmp
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise sap 15
8.33.1-1.30
fixed
suse enterprise sap 15 SP1
8.33.1-3.9.1
fixed
suse enterprise server 12 SP2
8.4.0-14.1
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 15
8.33.1-1.30
fixed
suse enterprise server 15 SP1
8.33.1-3.9.1
fixed
rsyslog-module-udpspoof
suse enterprise sap 12 SP5
8.24.0-3.28.2
fixed
suse enterprise sap 15
8.33.1-1.30
fixed
suse enterprise sap 15 SP1
8.33.1-3.9.1
fixed
suse enterprise server 12 SP2
8.4.0-14.1
fixed
suse enterprise server 12 SP5
8.24.0-3.28.2
fixed
suse enterprise server 15
8.33.1-1.30
fixed
suse enterprise server 15 SP1
8.33.1-3.9.1
fixed
syslog-service
suse enterprise desktop 15
2.0-2.23
fixed
suse enterprise desktop 15 SP1
2.0-2.23
fixed
suse enterprise sap 12 SP5
2.0-778.1
fixed
suse enterprise sap 15
2.0-2.23
fixed
suse enterprise sap 15 SP1
2.0-2.23
fixed
suse enterprise server 12 SP2
2.0-778.1
fixed
suse enterprise server 12 SP5
2.0-778.1
fixed
suse enterprise server 15
2.0-2.23
fixed
suse enterprise server 15 SP1
2.0-2.23
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
rsyslog
RHEL 6
0:5.8.10-9.el6_6
fixed
RHEL 7
0:7.4.7-7.el7_0
fixed
rsyslog-crypto
RHEL 7
0:7.4.7-7.el7_0
fixed
rsyslog-doc
RHEL 7
0:7.4.7-7.el7_0
fixed
rsyslog-elasticsearch
RHEL 7
0:7.4.7-7.el7_0
fixed
rsyslog-gnutls
RHEL 6
0:5.8.10-9.el6_6
fixed
RHEL 7
0:7.4.7-7.el7_0
fixed
rsyslog-gssapi
RHEL 6
0:5.8.10-9.el6_6
fixed
RHEL 7
0:7.4.7-7.el7_0
fixed
rsyslog-libdbi
RHEL 7
0:7.4.7-7.el7_0
fixed
rsyslog-mmaudit
RHEL 7
0:7.4.7-7.el7_0
fixed
rsyslog-mmjsonparse
RHEL 7
0:7.4.7-7.el7_0
fixed
rsyslog-mmnormalize
RHEL 7
0:7.4.7-7.el7_0
fixed
rsyslog-mmsnmptrapd
RHEL 7
0:7.4.7-7.el7_0
fixed
rsyslog-mysql
RHEL 6
0:5.8.10-9.el6_6
fixed
RHEL 7
0:7.4.7-7.el7_0
fixed
rsyslog-pgsql
RHEL 6
0:5.8.10-9.el6_6
fixed
RHEL 7
0:7.4.7-7.el7_0
fixed
rsyslog-relp
RHEL 6
0:5.8.10-9.el6_6
fixed
RHEL 7
0:7.4.7-7.el7_0
fixed
rsyslog-snmp
RHEL 6
0:5.8.10-9.el6_6
fixed
RHEL 7
0:7.4.7-7.el7_0
fixed
rsyslog-udpspoof
RHEL 7
0:7.4.7-7.el7_0
fixed
rsyslog7
RHEL 6
0:7.4.10-3.el6_6
fixed
rsyslog7-elasticsearch
RHEL 6
0:7.4.10-3.el6_6
fixed
rsyslog7-gnutls
RHEL 6
0:7.4.10-3.el6_6
fixed
rsyslog7-gssapi
RHEL 6
0:7.4.10-3.el6_6
fixed
rsyslog7-mysql
RHEL 6
0:7.4.10-3.el6_6
fixed
rsyslog7-pgsql
RHEL 6
0:7.4.10-3.el6_6
fixed
rsyslog7-relp
RHEL 6
0:7.4.10-3.el6_6
fixed
rsyslog7-snmp
RHEL 6
0:7.4.10-3.el6_6
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
rsyslog
Amazon Linux 1
0:5.8.10-9.29.amzn1
fixed
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-crypto
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-crypto-debuginfo
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-debuginfo
Amazon Linux 1
0:5.8.10-9.29.amzn1
fixed
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-debugsource
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-doc
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-elasticsearch
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-elasticsearch-debuginfo
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-gnutls
Amazon Linux 1
0:5.8.10-9.29.amzn1
fixed
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
rsyslog-gssapi
Amazon Linux 1
0:5.8.10-9.29.amzn1
fixed
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
rsyslog-kafka
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
rsyslog-libdbi
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
rsyslog-logrotate
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-mmaudit
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-mmaudit-debuginfo
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-mmfields
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-mmfields-debuginfo
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-mmjsonparse
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-mmjsonparse-debuginfo
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-mmkubernetes
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-mmkubernetes-debuginfo
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-mmnormalize
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-mmnormalize-debuginfo
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-mmsnmptrapd
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
rsyslog-mysql
Amazon Linux 1
0:5.8.10-9.29.amzn1
fixed
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
rsyslog-openssl
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-openssl-debuginfo
Amazon Linux 2023
0:8.2204.0-3.amzn2023.0.2
fixed
rsyslog-pgsql
Amazon Linux 1
0:5.8.10-9.29.amzn1
fixed
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
rsyslog-relp
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
rsyslog-snmp
Amazon Linux 1
0:5.8.10-9.29.amzn1
fixed
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
rsyslog-udpspoof
Amazon Linux 2
0:8.24.0-57.amzn2.2.0.1
fixed
Common Weakness Enumeration
References
http://advisories.mageia.org/MGASA-2014-0411.html
http://linux.oracle.com/errata/ELSA-2014-1654
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00005.html
http://lists.opensuse.org/opensuse-updates/2014-10/msg00020.html
http://lists.opensuse.org/opensuse-updates/2014-10/msg00021.html
http://rhn.redhat.com/errata/RHSA-2014-1397.html
http://rhn.redhat.com/errata/RHSA-2014-1654.html
http://rhn.redhat.com/errata/RHSA-2014-1671.html
http://secunia.com/advisories/61494
http://secunia.com/advisories/61720
http://secunia.com/advisories/61930
http://www.debian.org/security/2014/dsa-3040
http://www.mandriva.com/security/advisories?name=MDVSA-2015:130
http://www.openwall.com/lists/oss-security/2014/09/30/15
http://www.openwall.com/lists/oss-security/2014/10/03/1
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
http://www.rsyslog.com/remote-syslog-pri-vulnerability/
http://www.ubuntu.com/usn/USN-2381-1
http://advisories.mageia.org/MGASA-2014-0411.html
http://linux.oracle.com/errata/ELSA-2014-1654
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00005.html
http://lists.opensuse.org/opensuse-updates/2014-10/msg00020.html
http://lists.opensuse.org/opensuse-updates/2014-10/msg00021.html
http://rhn.redhat.com/errata/RHSA-2014-1397.html
http://rhn.redhat.com/errata/RHSA-2014-1654.html
http://rhn.redhat.com/errata/RHSA-2014-1671.html
http://secunia.com/advisories/61494
http://secunia.com/advisories/61720
http://secunia.com/advisories/61930
http://www.debian.org/security/2014/dsa-3040
http://www.mandriva.com/security/advisories?name=MDVSA-2015:130
http://www.openwall.com/lists/oss-security/2014/09/30/15
http://www.openwall.com/lists/oss-security/2014/10/03/1
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
http://www.rsyslog.com/remote-syslog-pri-vulnerability/
http://www.ubuntu.com/usn/USN-2381-1