Debian Security Advisory

DLA-3231-1 dlt-daemon -- LTS security update

Date Reported:
07 Dec 2022
Affected Packages:
dlt-daemon
Vulnerable:
Yes
Security database references:
In the Debian bugtracking system: Bug 976228, Bug 1014534.
In Mitre's CVE dictionary: CVE-2020-29394, CVE-2020-36244, CVE-2022-31291.
More information:

dlt-daemon, a Diagnostic Log and Trace logging daemon, had the following vulnerabilities reported:

  • CVE-2020-29394

    A buffer overflow in the dlt_filter_load function in dlt_common.c from dlt-daemon allows arbitrary code execution because fscanf is misused (no limit on the number of characters to be read in the format argument).

  • CVE-2020-36244

    dlt-daemon was vulnerable to a heap-based buffer overflow that could allow an attacker to remotely execute arbitrary code.

  • CVE-2022-31291

    An issue in dlt_config_file_parser.c of dlt-daemon allows attackers to cause a double free via crafted TCP packets.

For Debian 10 buster, these problems have been fixed in version 2.18.0-1+deb10u1.

We recommend that you upgrade your dlt-daemon packages.

For the detailed security status of dlt-daemon please refer to its security tracker page at: https://security-tracker.debian.org/tracker/dlt-daemon

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS