debian/sysstat vulnerabilities

Latest debian/sysstat CVEs

Newest publication first

1. DLA-4336-1 sysstat - security update

   Published 2025-10-17

   Unknown

2. DLA-3434-1 sysstat - security update

   Published 2023-05-27

   Unknown

3. CVE-2023-33204 sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377.

   Published 2023-05-18

   High·CVSS 7.8

   sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377.

4. DLA-3188-1 sysstat - security update

   Published 2022-11-14

   Unknown

5. CVE-2022-39377 sysstat Incorrect Buffer Size calculation on 32-bit systems results in RCE via buffer overflow

   Published 2022-11-08

   High·CVSS 7.8

   sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_structures contains a size_t overflow in sa_common.c. The allocate_structures function insufficiently checks bounds before ar...

6. CVE-2019-19725 sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.

   Published 2019-12-11

   Critical·CVSS 9.8

   sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.

7. CVE-2019-16167 sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in sa_common.c.

   Published 2019-09-09

   Medium·CVSS 5.5

   sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in sa_common.c.

8. CVE-2004-0108 The isag utility, which processes sysstat data, allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CAN-2004-0107.

   Published 2004-09-01

   Medium·CVSS 4.6

   The isag utility, which processes sysstat data, allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CAN-2004-0107.

9. CVE-2004-0107 The (1) post and (2) trigger scripts in sysstat 4.0.7 and earlier allow local users to overwrite arbitrary files via symlink attacks on temporary files, a different vulnerability than CVE-2004-0108.

   Published 2004-03-16

   Medium·CVSS 4.6

   The (1) post and (2) trigger scripts in sysstat 4.0.7 and earlier allow local users to overwrite arbitrary files via symlink attacks on temporary files, a different vulnerability than CVE-2004-0108.

10. DSA-460 sysstat - insecure temporary file

    Published 2004-03-10

    Unknown

11. CVE-2018-19517 An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memset call, as demonstrated by sadf.

    Medium·CVSS 5.5

    An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memset call, as demonstrated by sadf.

12. CVE-2018-19416 An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call, as demonstrated by sadf.

    High·CVSS 7.8

    An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call, as demonstrated by sadf.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.