- ----------------------------------------------------------------------- Debian LTS Advisory DLA-3231-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta December 07, 2022 https://wiki.debian.org/LTS - ----------------------------------------------------------------------- Package : dlt-daemon Version : 2.18.0-1+deb10u1 CVE ID : CVE-2020-29394 CVE-2020-36244 CVE-2022-31291 Debian Bug : 976228 1014534 dlt-daemon, a Diagnostic Log and Trace logging daemon, had the following vulnerabilities reported: CVE-2020-29394 A buffer overflow in the dlt_filter_load function in dlt_common.c from dlt-daemon allows arbitrary code execution because fscanf is misused (no limit on the number of characters to be read in the format argument). CVE-2020-36244 dlt-daemon was vulnerable to a heap-based buffer overflow that could allow an attacker to remotely execute arbitrary code. CVE-2022-31291 An issue in dlt_config_file_parser.c of dlt-daemon allows attackers to cause a double free via crafted TCP packets. For Debian 10 buster, these problems have been fixed in version 2.18.0-1+deb10u1. We recommend that you upgrade your dlt-daemon packages. For the detailed security status of dlt-daemon please refer to its security tracker page at: https://security-tracker.debian.org/tracker/dlt-daemon Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS