CVE-2016-6254 Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execu...
CriticalCVSS 9.1
EPSS 5.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted network packet.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/collectd(Debian:12) | < 5.5.2-1 | 5.5.2-1 |
| debian/collectd(Debian:13) | < 5.5.2-1 | 5.5.2-1 |
| debian linux | = 8.0 | No fix listed |
| collectd | >= 5.4.0, < 5.4.3 | 5.4.3 |
| collectd | >= 5.5.0, < 5.5.2 | 5.5.2 |
| fedoraproject fedora | = 23 | No fix listed |
| fedoraproject fedora | = 24 | No fix listed |
| alpine/collectd(Alpine:v3.10) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
| alpine/collectd(Alpine:v3.11) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
| alpine/collectd(Alpine:v3.12) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
| alpine/collectd(Alpine:v3.13) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
| alpine/collectd(Alpine:v3.14) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
| alpine/collectd(Alpine:v3.15) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
| alpine/collectd(Alpine:v3.16) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
| alpine/collectd(Alpine:v3.17) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
| alpine/collectd(Alpine:v3.18) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
| alpine/collectd(Alpine:v3.19) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
| alpine/collectd(Alpine:v3.20) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
| alpine/collectd(Alpine:v3.21) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
| alpine/collectd(Alpine:v3.22) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
| alpine/collectd(Alpine:v3.23) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
| alpine/collectd(Alpine:v3.24) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
| alpine/collectd(Alpine:v3.4) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
| alpine/collectd(Alpine:v3.5) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
| alpine/collectd(Alpine:v3.6) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/collectd(Alpine:v3.9) | >= 5.4.0, < 5.5.2-r0 | 5.5.2-r0 |
References
- Debian Security Tracker CVE-2016-6254 vendor-advisory
- collectd.org release-notes vendor-advisory
- DSA-3636 third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- FEDORA-2016-23f0d552e8 vendor-advisory
- FEDORA-2016-e16a14ffc5 vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking