CVE-2011-1490
First published: Thu Nov 14 2019(Updated: )
A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/rsyslog | 8.1901.0-1+deb10u2 8.2102.0-2+deb11u1 8.2302.0-1 8.2310.0-2 | |
| Rsyslog Rsyslog | <5.7.6 | |
| Debian Debian Linux | =8.0 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| Oracle Java Runtime Environment (JRE) | =11.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security-tracker.debian.org/tracker/CVE-2011-1490
- http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.html
- https://access.redhat.com/security/cve/cve-2011-1490
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1490
- https://github.com/rsyslog/rsyslog/commit/1ef709cc97d54f74d3fdeb83788cc4b01f4c6a2a
Frequently Asked Questions
What is CVE-2011-1490?
CVE-2011-1490 is a vulnerability in rsyslog before version 5.7.6 that could cause a memory leak and denial of service.
How does CVE-2011-1490 affect Rsyslog and Debian Linux?
CVE-2011-1490 affects Rsyslog versions before 5.7.6 and Debian Linux versions 8.0, 9.0, and 10.0.
What is the severity of CVE-2011-1490?
CVE-2011-1490 has a severity rating of medium, with a severity value of 5.5.
How can CVE-2011-1490 be exploited?
CVE-2011-1490 can be exploited by a local attacker sending a malicious log message, causing a memory leak and denial of service.
How can I fix CVE-2011-1490 in Debian Linux?
To fix CVE-2011-1490 in Debian Linux, update to the recommended versions: 8.1901.0-1+deb10u2, 8.2102.0-2+deb11u1, 8.2302.0-1, or 8.2310.0-2.
- collector/security-tracker-debian
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/weakness
- agent/references
- agent/severity
- agent/remedy
- agent/author
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- package-manager/debian
- vendor/rsyslog
- canonical/rsyslog rsyslog
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- vendor/opensuse
- canonical/opensuse opensuse
- version/opensuse opensuse/11.4