[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 575-1] collectd security update



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Package        : collectd
Version        : 5.1.0-3+deb7u1
CVE ID         : CVE-2016-6254
Debian Bug     : 832507 832577

Emilien Gaspar discovered that collectd, a statistics collection and
monitoring daemon, incorrectly processed incoming network
packets. This resulted in a heap overflow, allowing a remote attacker
to either cause a DoS via application crash, or potentially execute
arbitrary code.

Additionally, security researchers at Columbia University and the
University of Virginia discovered that collectd failed to verify a
return value during initialization. This meant the daemon could
sometimes be started without the desired, secure settings.

For Debian 7 "Wheezy", these problems have been fixed in version
5.1.0-3+deb7u1.

We recommend that you upgrade your collectd packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQIcBAEBAgAGBQJXnHy2AAoJEMwFfnIvH/zHP/YP/3nltzMK38uzFzaY3wgmN2Am
FoMfzYnauYT867Zb9IbpnRMYlWYoqSe7MLBSJ9xPOzo+JhEJkJxpNfyc4jSPMB6d
iU2p2bIzbXIu4tVYFBsFOvQW9KwouXR6ADe5KagsUJIKhZCJJqwWhrdYtp4QhBEP
8e/lJ+aE6sqtM1YNwe6YrTUcaGB5QLTea3nWYBTuthFw5bfOtjEnPNDOASA5VGc9
aZtDEYeclliUR9ktNziYUZAvA4BPNL9scOYbFdX8HTcLPPNsX0jOPd7SVDbHwtTc
Iwn5p5kspZIxGw8ivuceAuaKdyoF1tF9l5eDUHCUPmHdA0FGMvSDTUvEAws1Kjg2
LlH8ibFvHiymtJyHXoltJ/u80xjRsYBU1ag2cUyApyx0WhfgDBjde8boSxxydLIS
mUQcPFbJVCgVmOvB9ZHJX3IMFumD/Na8JrnCOoHtFwKsCLMNQ/Pkdkp6zgscWlZg
F+p3vrREoPDfouVSxWQJzzBlnrF6R1hJONkWkjNfHRzQxeXoM2Wa7YJWnkrfuQE9
MnqJJfUcl2Brc6RHsu1Q1rGKrzrUlCOo7EH++VMcP28sH84aAtKNTmi93Th3tbIR
2hMQo2XafNlxrExRv40W/Zq+doKSSoZpiUarHXtVXNVH6WA6K5Vre6k9qtOUCOjs
8fMC2uwoPnHoAr+X6SCF
=7YzU
-----END PGP SIGNATURE-----


Reply to: