Rainer Gerhards

**Name of the Vulnerable Software and Affected Versions** rsyslog versions prior to 8.4.2 sysklogd version 1.5 and earlier **Description** The issue affects the rsyslog package in Gentoo Linux and can lead to a disruption in the confidentiality, integrity, and availability of protected information. It is caused by an integer overflow when parsing PRI values, which can be exploited remotely. By sending a specially crafted message, an attacker can cause the service to crash, resulting in a denial of service. **Recommendations** For rsyslog versions prior to 8.4.2, update to version 8.4.2 or later to resolve the issue. For sysklogd version 1.5 and earlier, consider upgrading to a version later than 1.5 to mitigate the risk. As a temporary workaround, consider restricting access to the `PRI` parsing functionality until a patch is available.

**Name of the Vulnerable Software and Affected Versions** rsyslog versions prior to 7.6.6 rsyslog 8.x versions prior to 8.4.1 sysklogd version 1.5 and earlier **Description** The issue allows remote attackers to cause a denial of service, possibly execute arbitrary code, or have other unspecified impact via a crafted priority value that triggers an out-of-bounds array access. This can lead to a disruption of confidentiality, integrity, and availability of protected information. The vulnerability can be exploited remotely. **Recommendations** For rsyslog versions prior to 7.6.6, update to version 7.6.6 or later. For rsyslog 8.x versions prior to 8.4.1, update to version 8.4.1 or later. For sysklogd version 1.5 and earlier, update to a version later than 1.5. As a temporary workaround, consider restricting access to the service to minimize the risk of exploitation.