CVE-2008-5110

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

syslog-ng does not call chdir when it calls chroot, which might allow attackers to escape the intended jail. NOTE: this is only a vulnerability when a separate vulnerability is present. This flaw affects syslog-ng versions prior to and including 2.0.9.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791Issue Tracking, Third Party Advisory
http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083Broken Link
http://secunia.com/advisories/35748Third Party Advisory
http://secunia.com/advisories/40551Third Party Advisory
http://security.gentoo.org/glsa/glsa-200907-10.xmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2008/11/17/3Mailing List, Third Party Advisory
http://www.vupen.com/english/advisories/2010/1796Permissions Required, Third Party Advisory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791Issue Tracking, Third Party Advisory
http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083Broken Link
http://secunia.com/advisories/35748Third Party Advisory
http://secunia.com/advisories/40551Third Party Advisory
http://security.gentoo.org/glsa/glsa-200907-10.xmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2008/11/17/3Mailing List, Third Party Advisory
http://www.vupen.com/english/advisories/2010/1796Permissions Required, Third Party Advisory

Timeline

Published: Nov 17, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-51114.7Unspecified vulnerability in the socket function in Sun Solaris 10 and OpenSolaris snv_57 through snv_91, when InfiniBand hardware is not in CVE-2008-51125.0The LDAP server in Active Directory in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 responds differently to a failed bind attempt CVE-2008-51134.0WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to condu CVE-2008-51144.3Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allow remote attac CVE-2008-51156.8Cross-site request forgery (CSRF) vulnerability in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attacker CVE-2008-51167.8Directory traversal vulnerability in idm/includes/helpServer.jsp in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allow CVE-2008-51176.4Open redirect vulnerability in Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to redirect users CVE-2008-51184.3Sun Java System Identity Manager 6.0 through 6.0 SP4, 7.0, and 7.1 allows remote attackers to inject frames from arbitrary web sites and con CVE-2008-51194.3Cross-site scripting (XSS) vulnerability in search.php in Scripts4Profit DXShopCart 4.30mc allows remote attackers to inject arbitrary web s CVE-2008-512010.0Stack-based buffer overflow in the Process Software MultiNet finger service (aka FINGERD) for HP OpenVMS 8.3 allows remote attackers to exec CVE-2008-51217.2dne2000.sys in Citrix Deterministic Network Enhancer (DNE) 2.21.7.233 through 3.21.7.17464, as used in (1) Cisco VPN Client, (2) Blue Coat W CVE-2008-51227.5SQL injection vulnerability in WorkArea/ContentRatingGraph.aspx in Ektron CMS400.NET 7.5.2 and earlier allows remote attackers to execute ar