-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Package : collectd Version : 5.1.0-3+deb7u1 CVE ID : CVE-2016-6254 Debian Bug : 832507 832577
Emilien Gaspar discovered that collectd, a statistics collection and monitoring daemon, incorrectly processed incoming network packets. This resulted in a heap overflow, allowing a remote attacker to either cause a DoS via application crash, or potentially execute arbitrary code. Additionally, security researchers at Columbia University and the University of Virginia discovered that collectd failed to verify a return value during initialization. This meant the daemon could sometimes be started without the desired, secure settings. For Debian 7 "Wheezy", these problems have been fixed in version 5.1.0-3+deb7u1. We recommend that you upgrade your collectd packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQIcBAEBAgAGBQJXnHy2AAoJEMwFfnIvH/zHP/YP/3nltzMK38uzFzaY3wgmN2Am FoMfzYnauYT867Zb9IbpnRMYlWYoqSe7MLBSJ9xPOzo+JhEJkJxpNfyc4jSPMB6d iU2p2bIzbXIu4tVYFBsFOvQW9KwouXR6ADe5KagsUJIKhZCJJqwWhrdYtp4QhBEP 8e/lJ+aE6sqtM1YNwe6YrTUcaGB5QLTea3nWYBTuthFw5bfOtjEnPNDOASA5VGc9 aZtDEYeclliUR9ktNziYUZAvA4BPNL9scOYbFdX8HTcLPPNsX0jOPd7SVDbHwtTc Iwn5p5kspZIxGw8ivuceAuaKdyoF1tF9l5eDUHCUPmHdA0FGMvSDTUvEAws1Kjg2 LlH8ibFvHiymtJyHXoltJ/u80xjRsYBU1ag2cUyApyx0WhfgDBjde8boSxxydLIS mUQcPFbJVCgVmOvB9ZHJX3IMFumD/Na8JrnCOoHtFwKsCLMNQ/Pkdkp6zgscWlZg F+p3vrREoPDfouVSxWQJzzBlnrF6R1hJONkWkjNfHRzQxeXoM2Wa7YJWnkrfuQE9 MnqJJfUcl2Brc6RHsu1Q1rGKrzrUlCOo7EH++VMcP28sH84aAtKNTmi93Th3tbIR 2hMQo2XafNlxrExRv40W/Zq+doKSSoZpiUarHXtVXNVH6WA6K5Vre6k9qtOUCOjs 8fMC2uwoPnHoAr+X6SCF =7YzU -----END PGP SIGNATURE-----
