CVE-2016-6254 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Collectd

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-122 — Heap-based Buffer Overflow10 documents7 sources
Severity
9.1CRITICALNVD
EPSS
13.1%
top 5.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
CollectdDebian CollectdDebian Linux+1 more
Timeline
PublishedAug 19
Latest updateMay 14

Description

Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted network packet.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages4 packages

▶debiandebian/collectd< collectd 5.5.2-1 (bookworm)
▶NVDcollectd/collectd5.4.0 — 5.4.3+1
▶Debiancollectd/collectd< 5.5.2-1+3
▶Ubuntucollectd/collectd< 5.4.0-3ubuntu2.2+esm1+1

Also affects: Debian Linux 8.0, Fedora 23, 24

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-w8rr-j32h-prm7: Heap-based buffer overflow in the parse_packet function in network↗2022-05-14
▶
OSV
collectd vulnerabilities↗2021-03-15
▶
OSV
CVE-2016-6254: Heap-based buffer overflow in the parse_packet function in network↗2016-08-19
▶

📋Vendor Advisories

3
Ubuntu
collectd vulnerabilities↗2021-03-15
▶
Red Hat
collectd: heap overflow in the network plugin↗2016-07-26
▶
Debian
CVE-2016-6254: collectd - Heap-based buffer overflow in the parse_packet function in network.c in collectd...↗2016
▶

💬Community

3
Bugzilla
CVE-2016-6254 collectd: heap overflow in the network plugin [epel-all]↗2016-07-27
▶
Bugzilla
CVE-2016-6254 collectd: heap overflow in the network plugin↗2016-07-27
▶
Bugzilla
CVE-2016-6254 collectd: heap overflow in the network plugin [fedora-all]↗2016-07-27
▶