Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.

This update for rrdtool fixes the following issues :

  - CVE-2013-2131: Added check to the imginfo format to     prevent crash or exploit (boo#828003)

  - Fixed an infinite loop and crashing with pango     [boo#1080251]

This update for rrdtool provides the following fixes :

  - CVE-2013-2131: Enhance imginfo format validation checks     to prevent crashes. (bsc#828003)

  - Add rrdtool-cached sub-package to SLE 12-SP1.
    (bsc#967671)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

rrdtools was updated to add check to the imginfo format to prevent crash or code execution. (bnc#828003, CVE-2013-2131.)

This is an update that adds explicit check to the imginfo format. It may prevent crash/exploit of user space applications which pass user supplied format to the library call without checking.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is an update that adds explicit check to the imginfo format. It may prevent crash/exploit of user space applications which pass user supplied format to the library call without checking. This is an new version of rrdtool that fixes several bugs. The main new feature of this release is that large graph expressions are processed magnitudes faster. For more details see the original announcement http://oss.oetiker.ch/rrdtool/forum.en.html#nabble-f937719

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
106893	openSUSE Security Update : rrdtool (openSUSE-2018-175)	Nessus	SuSE Local Security Checks	medium
96405	SUSE SLED12 / SLES12 Security Update : rrdtool (SUSE-SU-2017:0103-1)	Nessus	SuSE Local Security Checks	medium
80050	openSUSE Security Update : rrdtool (openSUSE-SU-2014:1646-1)	Nessus	SuSE Local Security Checks	medium
67278	Fedora 18 : rrdtool-1.4.8-2.fc18 (2013-10309)	Nessus	Fedora Local Security Checks	medium
67277	Fedora 19 : rrdtool-1.4.8-2.fc19 (2013-10288)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-2131

high

Tenable Plugins

medium

medium

medium

medium

medium