Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (7)
| Vulnerability |
Summary |
Aliases |
|
VCID-1gf1-xw2a-dqgq
|
This GLSA contains notification of vulnerabilities found in several
Gentoo packages which have been fixed prior to January 1, 2012. The worst
of these vulnerabilities could lead to local privilege escalation and
remote code execution. Please see the package list and CVE identifiers
below for more information.
|
CVE-2011-1951
|
|
VCID-1xzy-xag3-5ybt
|
syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not allowed. It is also possible to pass partial wildcards such as `foo.a*c.bar` which glib matches but should be avoided / invalidated. This issue could have an impact on TLS connections, such as in man-in-the-middle situations. Version 4.8.2 contains a fix for the issue.
|
CVE-2024-47619
|
|
VCID-2rmg-7wqe-nqcq
|
Balabit syslog-ng 2.0, 3.0, 3.1, 3.2 OSE and PE, when running on FreeBSD or HP-UX, does not properly perform cast operations, which causes syslog-ng to use a default value of -1 to create log files with insecure permissions (07777), which allows local users to read and write to these log files.
|
CVE-2011-0343
|
|
VCID-8csr-snmd-dqby
|
Balabit Syslog-NG 1.4.x before 1.4.15, and 1.5.x before 1.5.20, when using template filenames or output, does not properly track the size of a buffer when constant characters are encountered during macro expansion, which allows remote attackers to cause a denial of service and possibly execute arbitrary code.
|
CVE-2002-1200
|
|
VCID-bfpg-vpax-ryhy
|
Syslog-ng does not properly initialize its chroot jail allowing for an
escape if a separate vulnerability in Syslog-ng is exploited.
|
CVE-2008-5110
|
|
VCID-c9ef-1f5v-y7b7
|
A Denial of Service vulnerability has been discovered in Syslog-ng.
|
CVE-2007-6437
|
|
VCID-d3hk-n3x4-dfb6
|
A denial of service vulnerability was discovered in rsyslog related to syslog input over the network.
|
CVE-2022-38725
|