CVE-2016-6254

Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted network packet.

Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted network packet.

Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted network packet.

These are all security issues fixed in the collectd-5.5.2-1.4 package on the GA media of openSUSE Tumbleweed.

This update for collectd fixes the following issues:

• heap overflow in the network plug-in (bsc#990853, CVE-2016-6254)
• add rrdcached plugin to filelist
• disable ipvs plugin for now: does not build

It was discovered that collectd mishandled certain malformed packets. A remote attacker could use this vulnerability to cause collectd to crash or possibly execute arbitrary code. (CVE-2016-6254)

It was discovered that collectd failed to handle certain input. An attacker could use this vulnerability to cause collectd to crash. (CVE-2017-16820)

It was discovered that collectd mishandles certain malformed network packets. A remote attacker could use this vulnerability to cause a Denial of Service or consume system resources. (CVE-2017-7401)