CVE-2014-3634

Publication date 1 October 2014

Last updated 24 July 2024

Ubuntu priority

Description

rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash), possibly execute arbitrary code, or have other unspecified impact via a crafted priority (PRI) value that triggers an out-of-bounds array access.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
rsyslog	17.04 zesty	Fixed 7.4.4-1ubuntu11
	16.10 yakkety	Fixed 7.4.4-1ubuntu11
	16.04 LTS xenial	Fixed 7.4.4-1ubuntu11
	15.10 wily	Fixed 7.4.4-1ubuntu11
	15.04 vivid	Fixed 7.4.4-1ubuntu11
	14.10 utopic	Fixed 7.4.4-1ubuntu11
	14.04 LTS trusty	Fixed 7.4.4-1ubuntu2.3
	12.04 LTS precise	Fixed 5.8.6-1ubuntu8.9
	10.04 LTS lucid	Fixed 4.2.0-2ubuntu8.3
sysklogd	17.04 zesty	Not in release
	16.10 yakkety	Not in release
	16.04 LTS xenial	Not in release
	15.10 wily	Not in release
	15.04 vivid	Not in release
	14.10 utopic	Not in release
	14.04 LTS trusty	Not in release
	12.04 LTS precise	Ignored end of life
	10.04 LTS lucid	Ignored end of life

Notes

mdeslaur

also see followup issue CVE-2014-3683

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
rsyslog	Upstream: http://www.rsyslog.com/files/download/rsyslog/pri-vuln.tar.gz

References

Related Ubuntu Security Notices (USN)

USN-2381-1
Rsyslog vulnerabilities
9 October 2014