Published: 19/08/2016 Updated: 07/11/2023

CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10

CVSS v3 Base Score: 9.1 | Impact Score: 5.2 | Exploitability Score: 3.9

VMScore: 570

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P

Heap-based buffer overflow in the parse_packet function in network.c in collectd prior to 5.4.3 and 5.x prior to 5.5.2 allows remote malicious users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted network packet.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian debian linux 8.0
collectd collectd
fedoraproject fedora 24
fedoraproject fedora 23

Debian Bug report logs - #832507 Heap overflow in the network plugin (CVE-2016-6254) Package: collectd; Maintainer for collectd is Sebastian Harl <tokkee@debianorg>; Source for collectd is src:collectd (PTS, buildd, popcon) Reported by: Florian Forster <octo@collectdorg> Date: Tue, 26 Jul 2016 08:51:02 UTC Severit ...

Emilien Gaspar discovered that collectd, a statistics collection and monitoring daemon, incorrectly processed incoming network packets This resulted in a heap overflow, allowing a remote attacker to either cause a DoS via application crash, or potentially execute arbitrary code Additionally, security researchers at Columbia University and the Uni ...

A heap-based buffer overflow in the parse_packet function in networkc in collectd allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted network packet ...

CWE-119 https://github.com/collectd/collectd/commit/b589096f907052b3a4da2b9ccc9b0e2e888dfc18 http://www.debian.org/security/2016/dsa-3636 http://collectd.org/news.shtml https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIZ5UXDOB7BA5NGE2F2I2BL4K6763DHW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CM4W5SJ4OTBGINGIN4NJLXCUZAZANO6J/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832507 https://nvd.nist.gov https://www.debian.org/security/./dsa-3636

CVE-2016-6254

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect