An integer overflow vulnerability has been found in sysstat which could result in arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-admin/sysstat | * | < 12.6.2-r1 | >= 12.6.2-r1 |
sysstat is a package containing a number of performance monitoring utilities for Linux, including sar, mpstat, iostat and sa tools.
A vulnerability has been discovered in sysstat. Please review the CVE identifier referenced below for details. This CVE improves on an incomplete fix for CVE-2022-39377.
On 32 bit systems, an integer overflow can be triggered when displaying activity data files.
There is no known workaround at this time.
All sysstat users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/sysstat-12.6.2-r1"
An integer overflow vulnerability has been found in sysstat which could result in arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-admin/sysstat | * | < 12.6.2-r1 | >= 12.6.2-r1 |
sysstat is a package containing a number of performance monitoring utilities for Linux, including sar, mpstat, iostat and sa tools.
On 32 bit systems, an integer overflow can be triggered when displaying activity data files.
Arbitrary code execution can be achieved via sufficiently crafted malicious input.
There is no known workaround at this time.
All sysstat users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/sysstat-12.6.2-r1"
A use-after-free in sysstat was discovered which may allow arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-admin/sysstat | * | < 12.2.1 | >= 12.2.1 |
sysstat is a package containing a number of performance monitoring utilities for Linux, including sar, mpstat, iostat and sa tools.
A double-free in sysstat’s check_file_actlst() function was discovered.
A local attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition.
There is no known workaround at this time.
All sysstat users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/sysstat-12.2.1"
Multiple vulnerabilities in the way sysstat handles symlinks may allow an attacker to execute arbitrary code or overwrite arbitrary files
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-admin/sysstat | x86 ppc sparc amd64 | < 5.0.2 | >= 5.0.2 |
sysstat is a package containing a number of performance monitoring utilities for Linux, including sar, mpstat, iostat and sa tools
There are two vulnerabilities in the way sysstat handles symlinks:
Both vulnerabilities may allow an attacker to overwrite arbitrary files under the permissions of the user executing any of the affected utilities.
A workaround is not currently known for this issue. All users are advised to upgrade to the latest version of the affected package.
Systat users should upgrade to version 4.2 or later:
# emerge sync # emerge -pv ">=app-admin/sysstat-5.0.2" # emerge ">=app-admin/sysstat-5.0.2"