7.5

CVE-2014-3634: rsyslog

CVSS: 7.5v2.0HighModified
AliasesMGASA-2014-0411RHSA-2014:1397RHSA-2014:1654
Published 02-11-2014Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2014-3634 is a high (CVSS 7.5) vulnerability in rsyslog. EPSS estimates a 7.55% chance of exploitation in the next 30 days, higher than 94.4% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
42/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v2.0 (NVD)
EPSS score
7.55%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 3 · Duplicates 1 · Related 2
DLA-72-1OPENSUSE-SU-2024:10498-1USN-2381-1CVE-2014-6388

Timeline

  1. 02-11-2014
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash), possibly execute arbitrary code, or have other unspecified impact via a crafted priority (PRI) value that triggers an out-of-bounds array access.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

7.55%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

0.00 pp

From 7.55% on 19-09-2026

19-09-202619-10-2026
EPSS score
7.55%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (rsyslog.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Redhat33 products
  • rsyslog< 0:7.4.7-7.el7_0 | < 0:5.8.10-9.el6_6
  • rsyslog-crypto< 0:7.4.7-7.el7_0
  • rsyslog-debuginfo< 0:7.4.7-7.el7_0 | < 0:5.8.10-9.el6_6
  • rsyslog-doc< 0:7.4.7-7.el7_0
  • rsyslog-elasticsearch< 0:7.4.7-7.el7_0
Debian2 products
  • inetutils< 2:1.9.2.39.3a460-1
  • rsyslog< 8.4.1-1 | < 5.8.11-3+deb7u1
Mageia2 products
  • rsyslog< 5.10.1-2.2.mga3
  • rsyslog< 5.10.1-3.2.mga4
Opensuse1 product
  • klogd&distro=openSUSE Tumbleweed< 1.4.1-786.3
Rsyslog1 product
  • rsyslog≤ 7.6.5 | 8.1.0 | 8.1.1 | 8.1.2 | 8.1.3 | 8.1.4 | 8.1.5 | 8.1.6 | 8.2.0 | 8.2.1 | 8.2.2 | 8.2.3 | 8.3.0 | 8.3.1 | 8.3.2 | 8.3.3 | 8.3.4 | 8.3.5 | 8.4.0
Sysklogd_project1 product
  • sysklogd≤ 1.5 | 1.1 | 1.2 | 1.3 | 1.4 | 1.4.1
Ubuntu1 product
  • rsyslog< 7.4.4-1ubuntu2.3

7 vendors · 41 products

References

39 links
Show all 39 references