CVE-2011-1489: debian debian_linux
Vulnerability summary
CVE-2011-1489 is a medium (CVSS 5.5) vulnerability in debian debian_linux. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 14-11-2019PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages were logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
0.00 pp
From 0.47% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (access.redhat.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- rsyslog< 5.7.6-1
- debian_linuxEOL8.0 | 9.0 | 10.0
Opensuse1 product
- opensuseEOL11.4
Rsyslog1 product
- rsyslog< 5.7.6
3 vendors · 4 products
References
5 links
- lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.htmlX Refsource MISCMailing ListThird Party Advisory
- github.com/rsyslog/rsyslog/commit/1ef709cc97d54f74d3fdeb83788cc4b01f4c6a2aX Refsource MISCPatchThird Party Advisory