Bug#832507: Heap overflow in the network plugin

2016-07-27 Thread Sebastian Harl 
Hi,

On Tue, Jul 26, 2016 at 10:48:58AM +0200, Florian Forster wrote:
> Emilien Gaspar has identified a heap overflow in collectd's network
> plugin which can be triggered remotely and is potentially exploitable.
> The identifier CVE-2016-6254 has been assigned to this issue.
> 
> This issue has been fixed in the released 5.5.2 and 5.4.3.
> Please update the version provided by Debian to a non-vulnerable
> version.
> 
> For the oldstable and stable branches, please add the following patches
> to fix the issue:
> 
> https://github.com/collectd/collectd/commit/b589096f907052b3a4da2b9ccc9b0e2e888dfc18

Thank you for reporting this.

> https://github.com/collectd/collectd/commit/8b4fed9940e02138b7e273e56863df03d1a39ef7
> 
> The second patch is unrelated to CVE-2016-6254. It fixes an
> initialization issue with libgcrypt which could theoretically lead to a
> half-initialized library being used.

I've reported a separate bug for this issue:
https://bugs.debian.org/832577

Cheers,
Sebastian

-- 
Sebastian "tokkee" Harl +++ GnuPG-ID: 0x2F1FFCC7 +++ http://tokkee.org/

Those who would give up Essential Liberty to purchase a little Temporary
Safety, deserve neither Liberty nor Safety. -- Benjamin Franklin



signature.asc
Description: Digital signature

Bug#832507: Heap overflow in the network plugin

2016-07-26 Thread Florian Forster 
Package: collectd
Version: 5.1.0-3
Severity: important
Tags: patch, security, upstream, fixed-upstream

Emilien Gaspar has identified a heap overflow in collectd's network
plugin which can be triggered remotely and is potentially exploitable.
The identifier CVE-2016-6254 has been assigned to this issue.

This issue has been fixed in the released 5.5.2 and 5.4.3.
Please update the version provided by Debian to a non-vulnerable
version.

For the oldstable and stable branches, please add the following patches
to fix the issue:

https://github.com/collectd/collectd/commit/b589096f907052b3a4da2b9ccc9b0e2e888dfc18
https://github.com/collectd/collectd/commit/8b4fed9940e02138b7e273e56863df03d1a39ef7

The second patch is unrelated to CVE-2016-6254. It fixes an
initialization issue with libgcrypt which could theoretically lead to a
half-initialized library being used.

Best regards,
—octo
-- 
collectd – The system statistics collection daemon
Website: http://collectd.org
Google+: http://collectd.org/+
GitHub:  https://github.com/collectd
Twitter: http://twitter.com/collectd


signature.asc
Description: Digital signature