| Package | Affected versions | Patched versions |
|---|---|---|
| collectd | = 4.0.0= 4.0.1= 4.0.2= 4.0.3= 4.0.4= 4.0.5= 4.0.6= 4.0.7= 4.0.8= 4.0.9= 4.1.0= 4.1.1= 4.1.2= 4.1.3= 4.1.4= 4.1.5= 4.1.6= 4.10= 4.10.1= 4.2.0= 4.2.1= 4.2.2= 4.2.3= 4.2.4= 4.2.5= 4.2.6= 4.2.7= 4.3.0= 4.3.1= 4.3.2= 4.3.3= 4.3.4= 4.4.0= 4.4.1= 4.4.2= 4.4.3= 4.4.4= 4.4.5= 4.5.0= 4.5.1= 4.5.2= 4.5.3= 4.5.4= 4.6.0= 4.6.1= 4.6.2= 4.6.3= 4.6.4= 4.6.5= 4.7.0= 4.7.1= 4.7.2= 4.7.3= 4.7.4= 4.7.5= 4.8.0= 4.8.1= 4.8.2= 4.8.3= 4.8.4= 4.8.5= 4.9.0= 4.9.1= 4.9.2= 4.9.3 |
The cu_rrd_create_file function (src/utils_rrdcreate.c) in collectd 4.x before 4.9.4 and before 4.10.2 allow remote attackers to cause a denial of service (assertion failure) via a packet with a timestamp whose value is 10 or less, as demonstrated by creating RRD files using the (1) RRDtool and (2) RRDCacheD plugins.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free