CVSS: 7.8EPSS: 4%CPEs: 4EXPL: 1CVE-2022-38725 – Debian Security Advisory 5369-1
https://notcve.org/view.php?id=CVE-2022-38725
23 Jan 2023 — An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected. Un desbordamiento de enteros en el analizador RFC3164 en One Identity syslog-ng 3.0 a 3.37 permite a atacantes remotos provocar una Denegación de Servicio a través de una entrada syslog manipulada que es mal manejad... • https://github.com/wdahlenburg/CVE-2022-38725 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.8EPSS: 0%CPEs: 16EXPL: 1CVE-2020-8019 – syslog-ng: Local privilege escalation from new to root in %post
https://notcve.org/view.php?id=CVE-2020-8019
29 Jun 2020 — A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of syslog-ng of SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Module for Legacy Software 12, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server for SAP 12-SP1; openSUSE Backports SLE-15-SP1, openSUSE Leap 15.1 allowed local attackers controlling the user news to escalate their privileges to root. This issue affects: SU... • https://bugzilla.suse.com/show_bug.cgi?id=1169385 • CWE-61: UNIX Symbolic Link (Symlink) Following •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2011-1951 – Gentoo Linux Security Advisory 201412-09
https://notcve.org/view.php?id=CVE-2011-1951
11 Jul 2011 — lib/logmatcher.c in Balabit syslog-ng before 3.2.4, when the global flag is set and when using PCRE 8.12 and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via a message that does not match a regular expression. lib/logmatcher.c en Balabit syslog-ng anterior a v3.2.4, cuando la bandera global está habilitada y cuando usa PCRE v8.12 y posiblemente otras versiones, permite a atacantes remotos provocar una denegación de servicio(consumo de memoria) a través d... • http://git.balabit.hu/?p=bazsi/syslog-ng-3.2.git%3Ba=commit%3Bh=09710c0b105e579d35c7b5f6c66d1ea5e3a3d3ff • CWE-399: Resource Management Errors •
CVSS: 7.1EPSS: 0%CPEs: 10EXPL: 0CVE-2011-0343
https://notcve.org/view.php?id=CVE-2011-0343
28 Jan 2011 — Balabit syslog-ng 2.0, 3.0, 3.1, 3.2 OSE and PE, when running on FreeBSD or HP-UX, does not properly perform cast operations, which causes syslog-ng to use a default value of -1 to create log files with insecure permissions (07777), which allows local users to read and write to these log files. Balabit syslog-ng v2.0, v3.0, v3.1, v3.2 OSE y PE, cuando se ejecutan en FreeBSD o HP-UX, no realiza adecuadamente las operaciones de conversión, esto provoca que syslog-ng emplee un valor por defecto de -1 para crea... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608491 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 1%CPEs: 1EXPL: 0CVE-2008-5110
https://notcve.org/view.php?id=CVE-2008-5110
17 Nov 2008 — syslog-ng does not call chdir when it calls chroot, which might allow attackers to escape the intended jail. NOTE: this is only a vulnerability when a separate vulnerability is present. This flaw affects syslog-ng versions prior to and including 2.0.9. syslog-ng no llama a chdir cuando llama a chroot, lo que podría permitir a los atacantes escapar de la jaula prevista. NOTA: esto es sólo una vulnerabilidad cuando una vulnerabilidad independiente esta presente. Esta fallo afecta a las versiones de syslog-ng ... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791 •
CVSS: 9.8EPSS: 6%CPEs: 8EXPL: 2CVE-2002-1200
https://notcve.org/view.php?id=CVE-2002-1200
28 Oct 2002 — Balabit Syslog-NG 1.4.x before 1.4.15, and 1.5.x before 1.5.20, when using template filenames or output, does not properly track the size of a buffer when constant characters are encountered during macro expansion, which allows remote attackers to cause a denial of service and possibly execute arbitrary code. Balabit Syslog-NG 1.4.x antes de 1.4.15, y 1.4.x antes de 1.5.20, cuando se usan plantillas de nombres de fichero o de salida, no controla adecuadamente el tamaño de un búfer cuando se encuentran carac... • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000547 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 1CVE-2000-1165
https://notcve.org/view.php?id=CVE-2000-1165
09 Jan 2001 — Balabit syslog-ng allows remote attackers to cause a denial of service (application crash) via a malformed log message that does not have a closing > in the priority specifier. • ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:02.syslog-ng.asc •