Descriptionlib/logmatcher.c in Balabit syslog-ng before 3.2.4, when the global flag is set and when using PCRE 8.12 and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via a message that does not match a regular expression.
Overall state of this security issue: Resolved
This issue is currently rated as having moderate severity.
|National Vulnerability Database|
Note from the SUSE Security TeamThis issue affects syslog-ng only when used with pcre 8.12 or later. As SUSE Linux Enterprise 11 only has pcre 7.8, it is not affected by this issue. Also openSUSE is not affected, as the newest shipping version (11.4) only has pcre 8.10. Future major versions of SUSE Linux Enterprise and openSUSE 12.1 will have a fixed syslog-ng package included. SUSE Bugzilla entry: 697374 [RESOLVED / FIXED] No SUSE Security Announcements cross referenced.
List of released packages
|Product(s)||Fixed package version(s)||References|
|SUSE Linux Enterprise Module for Legacy Software 12|| ||Patchnames:
SUSE Linux Enterprise Module for Legacy Software 12 GA syslog-ng
|openSUSE Tumbleweed|| ||Patchnames:
openSUSE Tumbleweed GA syslog-ng