CVE-2013-4758
Double free vulnerability in the writeDataError function in the ElasticSearch plugin ...
Double free vulnerability in the writeDataError function in the ElasticSearch plugin (omelasticsearch) in rsyslog before 7.4.2 and before 7.5.2 devel, when errorfile is set to local logging, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted JSON response.
Exploit likelihood
What each source reports
NVD Score used
Double free vulnerability in the writeDataError function in the ElasticSearch plugin (omelasticsearch) in rsyslog before 7.4.2 and before 7.5.2 devel, when errorfile is set to local logging, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted JSON response.
- Record
CVE-2013-4758- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
Double free vulnerability in the writeDataError function in the ElasticSearch plugin (omelasticsearch) in rsyslog before 7.4.2 and before 7.5.2 devel, when errorfile is set to local logging, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted JSON response.
- Record
CVE-2013-4758- Updated
- 2026-11-02
EUVDEUVD-2013-4606 No score
Double free vulnerability in the writeDataError function in the ElasticSearch plugin (omelasticsearch) in rsyslog before 7.4.2 and before 7.5.2 devel, when errorfile is set to local logging, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted JSON response.
- Record
EUVD-2013-4606- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h9vm-3m8j-cpjv No score
Double free vulnerability in the writeDataError function in the ElasticSearch plugin ...
Double free vulnerability in the writeDataError function in the ElasticSearch plugin (omelasticsearch) in rsyslog before 7.4.2 and before 7.5.2 devel, when errorfile is set to local logging, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted JSON response.
- Record
GHSA-h9vm-3m8j-cpjv- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10498-1 No score
rsyslog-8.23.0-2.1 on GA media
These are all security issues fixed in the rsyslog-8.23.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10498-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rsyslogopenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 8.23.0-2.1 | 8.23.0-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4758 is a medium vulnerability (CVSS 6.8) in Rsyslog, published October 4, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.33%, the 83rd percentile. No source names a fixed version.