CVE-2014-3683
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows...
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.
- Record
CVE-2014-3683- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.
- Record
CVE-2014-3683- Updated
- 2026-11-02
EUVDEUVD-2014-3629 No score
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.
- Record
EUVD-2014-3629- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cj25-wc2v-fhxm No score
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows...
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.
- Record
GHSA-cj25-wc2v-fhxm- Updated
- 2026-11-02
OSV No score
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.
- Record
CVE-2014-3683- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3683 No score
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.
- Record
DEBIAN-CVE-2014-3683- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10498-1 No score
rsyslog-8.23.0-2.1 on GA media
These are all security issues fixed in the rsyslog-8.23.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10498-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3683 No score
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.
- Record
UBUNTU-CVE-2014-3683- Updated
- 2026-11-02
OSVUSN-2381-1 No score
rsyslog vulnerabilities
It was discovered that Rsyslog incorrectly handled invalid PRI values. An attacker could use this issue to send malformed messages to the Rsyslog server and cause it to stop responding, resulting in a denial of service and possibly message loss. (CVE-2014-3634, CVE-2014-3683)
- Record
USN-2381-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rsyslogDebian:12 |
before 8.4.2-1 | 8.4.2-1 |
rsyslogDebian:13 |
before 8.4.2-1 | 8.4.2-1 |
rsyslogDebian:14 |
before 8.4.2-1 | 8.4.2-1 |
rsyslogDebian:6.0 |
before 4.6.4-2+deb6u1, plus listed versions 4.6.4-2 |
4.6.4-2+deb6u1 |
rsyslogDebian:7 |
before 5.8.11-3+deb7u2, plus listed versions 5.8.11-35.8.11-3+deb7u1 |
5.8.11-3+deb7u2 |
rsyslogUbuntu:14.04:LTS |
before 7.4.4-1ubuntu2.3, plus listed versions 5.8.11-2ubuntu47.4.4-1ubuntu17.4.4-1ubuntu27.4.4-1ubuntu2.1 |
7.4.4-1ubuntu2.3 |
rsyslogopenSUSE:Tumbleweed |
before 8.23.0-2.1 | 8.23.0-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3683 is a medium vulnerability (CVSS 5.0) in Rsyslog, published October 2, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.58%, the 91st percentile. Fixed in rsyslog 8.4.2-1.
References
lists.opensuse.org/opensuse-updates/2014-10/msg00020.html
openwall.com/lists/oss-security/2014/09/30/15
secunia.com/advisories/61494
Show 17 moreShow less
rsyslog.com/remote-syslog-pri-vulnerability-cve-2014-3683
ubuntu.com/usn/USN-2381-1
debian.org/security/2014/dsa-3047
oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
nvd.nist.gov/vuln/detail/CVE-2014-3683
github.com/advisories/GHSA-cj25-wc2v-fhxm
security-tracker.debian.org/tracker/CVE-2014-3683
ubuntu.com/security/CVE-2014-3683
cve.org/CVERecord?id=CVE-2014-3683
suse.com/security/cve/CVE-2011-3200