CVE-2014-3683

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-11-02 · updated 2026-06-17
Weakness: CWE-189

Description

Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.

Affected products

rsyslog: through 7.6.6; 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5 (+13)
Sysklogd Project Sysklogd: through 1.5; 1.1, 1.2, 1.3, 1.4, 1.4.1

References

http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00005.html
http://lists.opensuse.org/opensuse-updates/2014-10/msg00020.html
http://lists.opensuse.org/opensuse-updates/2014-10/msg00021.html
http://secunia.com/advisories/61494
http://www.debian.org/security/2014/dsa-3047
http://www.openwall.com/lists/oss-security/2014/09/30/15
http://www.openwall.com/lists/oss-security/2014/10/03/1
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
http://www.rsyslog.com/remote-syslog-pri-vulnerability-cve-2014-3683/
http://www.ubuntu.com/usn/USN-2381-1
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00005.html
http://lists.opensuse.org/opensuse-updates/2014-10/msg00020.html

Get alerted when CVE-2014-3683 or the next vulnerability affects your stack