Descriptionlib/logmatcher.c in Balabit syslog-ng before 3.2.4, when the global flag is set and when using PCRE 8.12 and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via a message that does not match a regular expression.
Overall state of this security issue: Resolved
This issue is currently rated as having moderate severity.
|National Vulnerability Database|
Note from the SUSE Security TeamThis issue affects syslog-ng only when used with pcre 8.12 or later. As SUSE Linux Enterprise 11 only has pcre 7.8, it is not affected by this issue. Also openSUSE is not affected, as the newest shipping version (11.4) only has pcre 8.10. Future major versions of SUSE Linux Enterprise and openSUSE 12.1 will have a fixed syslog-ng package included. SUSE Bugzilla entry: 697374 [RESOLVED / FIXED] No SUSE Security Announcements cross referenced.
List of released packages
|Product(s)||Fixed package version(s)||References|
|SUSE Linux Enterprise High Performance Computing 12 |
SUSE Linux Enterprise Module for Legacy 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server 12 SP3
SUSE Linux Enterprise Server 12 SP4
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server for SAP Applications 12 SP3
SUSE Linux Enterprise Server for SAP Applications 12 SP4
SUSE Linux Enterprise Server for SAP Applications 12 SP5
| ||Patchnames: |
SUSE Linux Enterprise Module for Legacy 12 GA syslog-ng-3.4.5-3.2
|openSUSE Tumbleweed|| ||Patchnames: |
openSUSE Tumbleweed GA syslog-ng-3.8.1-2.2
SUSE Timeline for this CVECVE page created: Fri Jun 28 12:24:58 2013
CVE page last modified: Fri Oct 7 12:46:05 2022