CVE catalog

CVE-2008-5110

syslog-ng: CVE-2008-5110

Severity: Low
Published: Nov 17, 2008, 10:21:27 PM UTC
Source: [NVD] · [CVE record]
EPSS: 2.19% · Oct 25, 2026

syslog-ng does not call chdir when it calls chroot, which might allow attackers to escape the intended jail. NOTE: this is only a vulnerability when a separate vulnerability is present. This flaw affects syslog-ng versions prior to and including 2.0.9.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	syslog-ng	sid	`4.12.0-2`	fixed
Debian	syslog-ng	forky	`4.8.1-7`	fixed
Debian	syslog-ng	trixie	`4.8.1-5+deb13u1`	fixed
Debian	syslog-ng	bookworm	`3.38.1-5+deb12u1`	fixed
Opensuse	syslog-ng	tumbleweed	`3.33.2-1.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	syslog-ng	source	sid	`2.0.9-4.1`	unimportant	Not reported	[505791]
Debian	syslog-ng	source	forky	`2.0.9-4.1`	unimportant	Not reported	[505791]
Debian	syslog-ng	source	trixie	`2.0.9-4.1`	unimportant	Not reported	[505791]
Debian	syslog-ng	source	bookworm	`2.0.9-4.1`	unimportant	Not reported	[505791]
Opensuse	syslog-ng	rpm	tumbleweed	`3.33.2-1.2`	Not reported	OPENSUSE-SU-2024:11418-1	Not reported

[Debian bug #505791]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[libevtlog-4_12-0]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-bigquery]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-bpf]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-clickhouse]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-cloudauth]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-devel]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-geoip]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-grpc]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-http]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-loki]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-mqtt]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-opentelemetry]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-pubsub]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-python]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-python-modules]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-redis]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-smtp]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-snmp]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-sql]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.33.2-1.2
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[syslog-ng]Fixed
Details (2)
- 3.38.1-5+deb12u1 · all · bookworm
  Fixed · Fixed: 2.0.9-4.1
  dsa · syslog-ng · debian · bookworm; dsa · syslog-ng · debian · 12
- 3.38.1-5+deb12u1 · all · bookworm
  Fixed · Fixed: 2.0.9-4.1
  dsa · syslog-ng · debian · bookworm; dsa · syslog-ng · debian · 12

Next results

Observed: Oct 23, 2026, 5:04:23 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]