Vulnerabilities

TI-2024-31899 CVE-2024-47619

tranport: TLS host name wildcard matching too lax

HIGH 72

syslog-ng is an enhanced log daemo.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00375 Published 2025-05-07 Fixed in 4.8.2 CWE-295

TI-2022-18249 CVE-2022-38725

An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37…

MEDIUM 44

An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02472 Published 2023-01-23 No fix listed CWE-190

TI-2020-06489 CVE-2020-8019 · GHSA-4j55-xp84-jjv2

syslog-ng: Local privilege escalation from new to root in %post

LOW 35

A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of syslog-ng of SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Module for Legacy Software 12,…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00521 Published 2020-06-29 Fixed in 2.0.9-27.34.40.5.1, 3.6.4-12.8.1 +2 CWE-61

TI-2011-01722 CVE-2011-1951 · GHSA-7jqv-hh4c-ww3h

lib/logmatcher.c in Balabit syslog-ng before 3.2.4, when the global flag is set and when…

LOW 25

lib/logmatcher.c in Balabit syslog-ng before 3.2.4, when the global flag is set and when using PCRE 8.12 and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via a messag…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02462 Published 2011-07-11 No fix listed CWE-399

TI-2011-00296 CVE-2011-0343 · GHSA-mw34-97q8-x4qh

Balabit syslog-ng 2.0, 3.0, 3.1, 3.2 OSE and PE, when running on FreeBSD or HP-UX, does…

LOW 31

Balabit syslog-ng 2.0, 3.0, 3.1, 3.2 OSE and PE, when running on FreeBSD or HP-UX, does not properly perform cast operations, which causes syslog-ng to use a default value of -1 to create log files with insecure permissi…

CVSS 2.0MEDIUM 6.9 Local No auth Interaction — EPSS 0.00377 Published 2011-01-28 No fix listed CWE-264

TI-2008-04861 CVE-2008-5110 · GHSA-423j-83rg-3cgc

syslog-ng does not call chdir when it calls chroot, which might allow attackers to escape…

MEDIUM 44

syslog-ng does not call chdir when it calls chroot, which might allow attackers to escape the intended jail.

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.02192 Published 2008-11-17 No fix listed

TI-2002-01161 CVE-2002-1200 · GHSA-rjhm-8rqf-6wp8

Balabit Syslog-NG 1.4.x before 1.4.15, and 1.5.x before 1.5.20, when using template…

MEDIUM 41

Balabit Syslog-NG 1.4.x before 1.4.15, and 1.5.x before 1.5.20, when using template filenames or output, does not properly track the size of a buffer when constant characters are encountered during macro expansion, which…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.05578 Published 2004-09-01 No fix listed CWE-119