Summary
It was discovered that Sysstat incorrectly handled certain arithmetic
multiplications. An attacker could use this issue to cause Sysstat to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue was only fixed for Ubuntu 16.04 LTS. (CVE-2022-39377)
It was discovered that Sysstat incorrectly handled certain arithmetic
multiplications in 64-bit systems, as a result of an incomplete fix for
CVE-2022-39377. An attacker could use this issue to cause Sysstat to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2023-33204)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | sysstat | 12.2.0-2ubuntu0.3 |
| Ubuntu · 22.04 LTS 22.04:LTS | sysstat | 12.5.2-2ubuntu0.2 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | sysstat | 10.2.0-1ubuntu0.1~esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | sysstat | 11.2.0-1ubuntu0.3+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | sysstat | 11.6.1-1ubuntu0.2+esm1 |
Vulnerabilities 2
-
High 7.8
sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists …
-
High 7.0
sysstat Incorrect Buffer Size calculation on 32-bit systems results in RCE via buffer overflow
sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_structures contains a size_t overflow in sa_common.c. The allocate_structures function insufficiently ch…