Bugzilla – Bug 990853
VUL-0: CVE-2016-6254: collectd: heap overflow in the network plug-in
Last modified: 2020-04-23 12:06:17 UTC
via rh#1360709 The following flaw was found in collectd: Emilien Gaspar has identified a heap overflow in collectd's network plugin which can be triggered remotely and is potentially exploitable. The identifier CVE-2016-6254 has been assigned to this issue. This issue has been fixed in the released 5.5.2 and 5.4.3. Upstream patches: https://github.com/collectd/collectd/commit/b589096f907052b3a4da2b9ccc9b0e2e888dfc18 https://github.com/collectd/collectd/commit/8b4fed9940e02138b7e273e56863df03d1a39ef7 The second patch is unrelated to CVE-2016-6254. It fixes an initialization issue with libgcrypt which could theoretically lead to a half-initialized library being used. References: https://bugzilla.redhat.com/show_bug.cgi?id=1360709 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6254 http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-6254.html
openSUSE is affected.
I have fixed it: created request id 118759 Back to security.
The SR has been declined. https://build.suse.de/request/show/118759 Leonardo, Andreas could you please tell me which branch you would like to have ?
The submission target is SUSE:SLE-11-SP2:Update. We never released an update for collectd, so the latest sources of this package is still in one of the old projects which are no longer used: SUSE:SLE-11-SP2:Update:Products:Test. One solution option: > $ iosc branch -M -N SUSE:SLE-11-SP2:Update/collectd > $ iosc copypac -K SUSE:SLE-11-SP2:Update:Products:Test/collectd \ > home:schubi2:branches:SUSE:SLE-11-SP2:Update/collectd.SUSE_SLE-11-SP2_Update > <add the fix for this bug> > $ iosc mr home:schubi2:branches:SUSE:SLE-11-SP2:Update \ > collectd.SUSE_SLE-11-SP2_Update SUSE:SLE-11-SP2:Update
OK, next try : SR 119671 . There is anyhow an fix from Rudi too.
SUSE-SU-2016:2187-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 990853 CVE References: CVE-2016-6254 Sources used: SUSE Webyast 1.3 (src): collectd-4.9.4-0.25.1 SUSE Lifecycle Management Server 1.3 (src): collectd-4.9.4-0.25.1
all done closing