PT-2016-6807 · Collectd+2 · Collectd+2

Emilien Gaspar · Published 2016-07-30 · Updated 2021-03-15 · CVE-2016-6254

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions collectd versions prior to 5.4.3 collectd versions 5.x prior to 5.5.2

Description The issue is related to a heap-based buffer overflow in the parse packet function in network.c. This can be exploited by remote attackers through a crafted network packet, potentially leading to a denial of service (daemon crash) or possibly the execution of arbitrary code.

Recommendations For versions prior to 5.4.3, update to version 5.4.3 or later. For versions 5.x prior to 5.5.2, update to version 5.5.2 or later.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2016-2096

CVE-2016-6254

DLA-575-1

DSA-3636-1

OPENSUSE-SU-2024:10462-1

SUSE-SU-2016:2187-1

USN-4793-1

Affected Products

Alt Linux

Ubuntu

Collectd

References · 23

• https://github.com/collectd/collectd/commit/b589096f907052b3a4da2b9ccc9b0e2e888dfc18 · Patch
• https://osv.dev/vulnerability/USN-4793-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4793-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-6254 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIZ5UXDOB7BA5NGE2F2I2BL4K6763DHW · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-6254 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-6254 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2016-6254 · Vendor Advisory
• http://collectd.org/news.shtml · Vendor Advisory
• http://debian.org/security/2016/dsa-3636 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CM4W5SJ4OTBGINGIN4NJLXCUZAZANO6J · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6254 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16820 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2187-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-6254 · Vendor Advisory