CVE-2007-6437

Published: Dec 19, 2007Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Balabit syslog-ng 2.0.x before 2.0.6 and 2.1.x before 2.1.8 allows remote attackers to cause a denial of service (crash) via a message with a timestamp that does not contain a trailing space, which triggers a NULL pointer dereference.

Affected (2)

Products: Balabit: Syslog Ng Open Source Edition, Syslog Ng Premium Edition

Balabit

2 products

Syslog Ng Open Source Edition

Syslog Ng Premium Edition

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Balabit Syslog Ng Open Source Edition	Up to 2.0.6
Balabit Syslog Ng Premium Edition	Up to 2.1.8

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (32)

http://seclists.org/bugtraq/2007/Dec/0202.html

Source: cve@mitre.org

http://secunia.com/advisories/28118

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28279

Source: cve@mitre.org

http://secunia.com/advisories/28372

Source: cve@mitre.org

http://secunia.com/advisories/28483

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-200712-19.xml

Source: cve@mitre.org

http://securitytracker.com/id?1019105

Source: cve@mitre.org

http://www.debian.org/security/2008/dsa-1464

Source: cve@mitre.org

http://www.osvdb.org/39551

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/485181/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/26897

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/4257

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=426173

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/39082

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00606.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00610.html

Source: cve@mitre.org

http://seclists.org/bugtraq/2007/Dec/0202.html