Upstream information

CVE-2011-1951 at MITRE


lib/logmatcher.c in Balabit syslog-ng before 3.2.4, when the global flag is set and when using PCRE 8.12 and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via a message that does not match a regular expression.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 4.3
Vector AV:N/AC:M/Au:N/C:N/I:N/A:P
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Partial

Note from the SUSE Security Team

This issue affects syslog-ng only when used with pcre 8.12 or later. As SUSE Linux Enterprise 11 only has pcre 7.8, it is not affected by this issue. Also openSUSE is not affected, as the newest shipping version (11.4) only has pcre 8.10. Future major versions of SUSE Linux Enterprise and openSUSE 12.1 will have a fixed syslog-ng package included.

SUSE Bugzilla entry: 697374 [RESOLVED / FIXED]

No SUSE Security Announcements cross referenced.

List of released packages

Product(s) Fixed package version(s) References
SUSE Linux Enterprise Module for Legacy Software 12
  • syslog-ng >= 3.4.5-3.5
SUSE Linux Enterprise Module for Legacy Software 12 GA syslog-ng
openSUSE Tumbleweed
  • syslog-ng >= 3.8.1-2.2
  • syslog-ng-curl >= 3.8.1-2.2
  • syslog-ng-devel >= 3.8.1-2.2
  • syslog-ng-geoip >= 3.8.1-2.2
  • syslog-ng-java >= 3.8.1-2.2
  • syslog-ng-python >= 3.8.1-2.2
  • syslog-ng-redis >= 3.8.1-2.2
  • syslog-ng-smtp >= 3.8.1-2.2
  • syslog-ng-sql >= 3.8.1-2.2
openSUSE Tumbleweed GA syslog-ng