[SECURITY] [DLA 575-1] collectd security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Package : collectd
Version : 5.1.0-3+deb7u1
CVE ID : CVE-2016-6254
Debian Bug : 832507 832577
Emilien Gaspar discovered that collectd, a statistics collection and
monitoring daemon, incorrectly processed incoming network
packets. This resulted in a heap overflow, allowing a remote attacker
to either cause a DoS via application crash, or potentially execute
arbitrary code.
Additionally, security researchers at Columbia University and the
University of Virginia discovered that collectd failed to verify a
return value during initialization. This meant the daemon could
sometimes be started without the desired, secure settings.
For Debian 7 "Wheezy", these problems have been fixed in version
5.1.0-3+deb7u1.
We recommend that you upgrade your collectd packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iQIcBAEBAgAGBQJXnHy2AAoJEMwFfnIvH/zHP/YP/3nltzMK38uzFzaY3wgmN2Am
FoMfzYnauYT867Zb9IbpnRMYlWYoqSe7MLBSJ9xPOzo+JhEJkJxpNfyc4jSPMB6d
iU2p2bIzbXIu4tVYFBsFOvQW9KwouXR6ADe5KagsUJIKhZCJJqwWhrdYtp4QhBEP
8e/lJ+aE6sqtM1YNwe6YrTUcaGB5QLTea3nWYBTuthFw5bfOtjEnPNDOASA5VGc9
aZtDEYeclliUR9ktNziYUZAvA4BPNL9scOYbFdX8HTcLPPNsX0jOPd7SVDbHwtTc
Iwn5p5kspZIxGw8ivuceAuaKdyoF1tF9l5eDUHCUPmHdA0FGMvSDTUvEAws1Kjg2
LlH8ibFvHiymtJyHXoltJ/u80xjRsYBU1ag2cUyApyx0WhfgDBjde8boSxxydLIS
mUQcPFbJVCgVmOvB9ZHJX3IMFumD/Na8JrnCOoHtFwKsCLMNQ/Pkdkp6zgscWlZg
F+p3vrREoPDfouVSxWQJzzBlnrF6R1hJONkWkjNfHRzQxeXoM2Wa7YJWnkrfuQE9
MnqJJfUcl2Brc6RHsu1Q1rGKrzrUlCOo7EH++VMcP28sH84aAtKNTmi93Th3tbIR
2hMQo2XafNlxrExRv40W/Zq+doKSSoZpiUarHXtVXNVH6WA6K5Vre6k9qtOUCOjs
8fMC2uwoPnHoAr+X6SCF
=7YzU
-----END PGP SIGNATURE-----
Reply to: