CVE-2002-1200

NameCVE-2002-1200
DescriptionBalabit Syslog-NG 1.4.x before 1.4.15, and 1.5.x before 1.5.20, when using template filenames or output, does not properly track the size of a buffer when constant characters are encountered during macro expansion, which allows remote attackers to cause a denial of service and possibly execute arbitrary code.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDSA-175

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
syslog-ng (PTS)buster3.19.1-5fixed
buster (security)3.19.1-5+deb10u1fixed
bullseye3.28.1-2fixed
bullseye (security)3.28.1-2+deb11u1fixed
bookworm, sid3.38.1-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
syslog-ngsourcewoody1.5.15-1.1DSA-175
syslog-ngsource(unstable)1.5.21-1
Search for package or bug name: Reporting problems