syslog-ng

8 results · Feed

• High 7.1
  CVE-2026-39879

  SQL injection in syslog-ng SQL destionation driver

  Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This…

  syslog-ng syslog-ng syslog-ng syslog-ng Debian Ubuntu
  Jul 20, 2026
• High 7.5
  CVE-2024-47619

  tranport: TLS host name wildcard matching too lax

  syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not allowed. It is also possible to pass partial wildcards such as `foo.a*c.bar` which glib matches but should be a…

  syslog-ng syslog-ng syslog-ng syslog-ng Debian Ubuntu
  May 7, 2025
• High 7.5
  CVE-2022-38725 Public exploit

  An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a…

  syslog-ng syslog-ng syslog-ng Debian Ubuntu Alpine
  Jan 23, 2023
• Unscored —
  CVE-2011-1951

  lib/logmatcher.c in Balabit syslog-ng before 3.2.4, when the global flag is set and when using PCRE 8.12 and possibly o…

  syslog-ng Debian
  Jul 11, 2011
• Unscored —
  CVE-2011-0343

  Balabit syslog-ng 2.0, 3.0, 3.1, 3.2 OSE and PE, when running on FreeBSD or HP-UX, does not properly perform cast opera…

  syslog-ng Debian
  Jan 28, 2011
• Unscored —
  CVE-2008-5110

  syslog-ng does not call chdir when it calls chroot, which might allow attackers to escape the intended jail. NOTE: this…

  syslog-ng Debian
  Nov 17, 2008
• Unscored —
  CVE-2007-6437

  Balabit syslog-ng 2.0.x before 2.0.6 and 2.1.x before 2.1.8 allows remote attackers to cause a denial of service (crash…

  syslog-ng Debian
  Dec 19, 2007
• Unscored —
  CVE-2002-1200

  Balabit Syslog-NG 1.4.x before 1.4.15, and 1.5.x before 1.5.20, when using template filenames or output, does not prope…

  syslog-ng Debian
  Sep 1, 2004