CVE-2014-3683
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows...
CVE-2014-3683 is a medium vulnerability (CVSS 5.0) in Rsyslog, published October 2, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.58%, the 91st percentile. Fixed in rsyslog 8.4.2-1.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 4.58%EPSS, 91st percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
8.4.2-1rsyslog +7 more
Description
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rsyslogDebian:12 | before 8.4.2-1 | 8.4.2-1 |
rsyslogDebian:13 | before 8.4.2-1 | 8.4.2-1 |
rsyslogDebian:14 | before 8.4.2-1 | 8.4.2-1 |
rsyslogDebian:6.0 From an advisory covering 2 CVEs | before 4.6.4-2+deb6u1, plus listed versions 4.6.4-2 | 4.6.4-2+deb6u1 |
rsyslogDebian:7 | before 5.8.11-3+deb7u2, plus listed versions 5.8.11-35.8.11-3+deb7u1 | 5.8.11-3+deb7u2 |
rsyslogUbuntu:14.04:LTS | before 7.4.4-1ubuntu2.3, plus listed versions 5.8.11-2ubuntu47.4.4-1ubuntu17.4.4-1ubuntu27.4.4-1ubuntu2.1 | 7.4.4-1ubuntu2.3 |
rsyslogUbuntu:14.04:LTS From an advisory covering 2 CVEs | before 7.4.4-1ubuntu2.3, plus listed versions 5.8.11-2ubuntu47.4.4-1ubuntu17.4.4-1ubuntu27.4.4-1ubuntu2.1 | 7.4.4-1ubuntu2.3 |
rsyslogopenSUSE:Tumbleweed From an advisory covering 6 CVEs | before 8.23.0-2.1 | 8.23.0-2.1 |
What each source reports
NVD Score used
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.
- Record
CVE-2014-3683- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE ListNo score
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.
- Record
CVE-2014-3683- Updated
- 2026-11-02
EUVDEUVD-2014-3629No score
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.
- Record
EUVD-2014-3629- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cj25-wc2v-fhxmNo score
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows...
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.
- Record
GHSA-cj25-wc2v-fhxm- Updated
- 2026-11-02
OSVNo score
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.
- Record
CVE-2014-3683- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3683No score
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.
- Record
DEBIAN-CVE-2014-3683- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10498-1No score
rsyslog-8.23.0-2.1 on GA media
These are all security issues fixed in the rsyslog-8.23.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10498-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3683No score
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.
- Record
UBUNTU-CVE-2014-3683- Updated
- 2026-11-02
OSVUSN-2381-1No score
rsyslog vulnerabilities
It was discovered that Rsyslog incorrectly handled invalid PRI values. An attacker could use this issue to send malformed messages to the Rsyslog server and cause it to stop responding, resulting in a denial of service and possibly message loss. (CVE-2014-3634, CVE-2014-3683)
- Record
USN-2381-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.opensuse.org/opensuse-updates/2014-10/msg00020.html
openwall.com/lists/oss-security/2014/09/30/15
secunia.com/advisories/61494
Show 17 moreShow less
rsyslog.com/remote-syslog-pri-vulnerability-cve-2014-3683
ubuntu.com/usn/USN-2381-1
debian.org/security/2014/dsa-3047
oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
nvd.nist.gov/vuln/detail/CVE-2014-3683
github.com/advisories/GHSA-cj25-wc2v-fhxm
security-tracker.debian.org/tracker/CVE-2014-3683
ubuntu.com/security/CVE-2014-3683
cve.org/CVERecord?id=CVE-2014-3683
suse.com/security/cve/CVE-2011-3200