CVE-2014-3683

Publication date 2 October 2014

Last updated 24 July 2024

Ubuntu priority

Description

Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
rsyslog	17.04 zesty	Fixed in 7.4.4-1ubuntu11
	16.10 yakkety	Fixed in 7.4.4-1ubuntu11
	16.04 LTS xenial	Fixed in 7.4.4-1ubuntu11
	15.10 wily	Fixed in 7.4.4-1ubuntu11
	15.04 vivid	Fixed in 7.4.4-1ubuntu11
	14.10 utopic	Fixed in 7.4.4-1ubuntu11
	14.04 LTS trusty	Fixed in 7.4.4-1ubuntu2.3
	12.04 LTS precise	Fixed in 5.8.6-1ubuntu8.9
	10.04 LTS lucid	Fixed in 4.2.0-2ubuntu8.3
sysklogd	17.04 zesty	Not in release
	16.10 yakkety	Not in release
	16.04 LTS xenial	Not in release
	15.10 wily	Not in release
	15.04 vivid	Not in release
	14.10 utopic	Not in release
	14.04 LTS trusty	Not in release
	12.04 LTS precise	Ignored end of life
	10.04 LTS lucid	Ignored end of life

Notes

mdeslaur

incomplete fix for CVE-2014-3634

References

Related Ubuntu Security Notices (USN)

USN-2381-1
Rsyslog vulnerabilities
9 October 2014