{"id":"CVE-2016-6254","details":"Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted network packet.","modified":"2026-07-08T10:53:37.988574Z","published":"2016-08-19T21:59:13.290Z","related":["SUSE-SU-2016:2187-1","openSUSE-SU-2024:10462-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"vendor_product":"fedoraproject:fedora","cpes":["cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"23"},{"last_affected":"23"},{"introduced":"24"},{"last_affected":"24"}],"source":"CPE_STRING"}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CM4W5SJ4OTBGINGIN4NJLXCUZAZANO6J/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIZ5UXDOB7BA5NGE2F2I2BL4K6763DHW/"},{"type":"ADVISORY","url":"http://collectd.org/news.shtml"},{"type":"ADVISORY","url":"http://www.debian.org/security/2016/dsa-3636"},{"type":"FIX","url":"https://github.com/collectd/collectd/commit/b589096f907052b3a4da2b9ccc9b0e2e888dfc18"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/collectd/collectd","events":[{"introduced":"f6b9d3b2d95a140eaf9537cae08069b6856684b2"},{"fixed":"c0f5748983a962f7be82bf49ac6c28a59d4658ff"},{"introduced":"ffc3836c22daa43aec1e28dc97c92f8e60b1b5ee"},{"fixed":"c0db1cfee44a6393143537a71ab1b651d1df6961"},{"fixed":"b589096f907052b3a4da2b9ccc9b0e2e888dfc18"}],"database_specific":{"cpe":"cpe:2.3:a:collectd:collectd:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.4.0"},{"fixed":"5.4.3"},{"introduced":"5.5.0"},{"fixed":"5.5.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["collectd-5.5.1","collectd-5.5.0","collectd-5.4.2","collectd-5.4.1","collectd-5.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-6254.json","vanir_signatures_modified":"2026-07-08T10:53:37Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/collectd/collectd/commit/b589096f907052b3a4da2b9ccc9b0e2e888dfc18","target":{"file":"src/network.c"},"deprecated":false,"digest":{"line_hashes":["306965870653954072527171272527053320127","73541933529261276942652323967835559474","211364815091471671335292792811151251480","146709269129839664605757152539845208149","306965870653954072527171272527053320127","73541933529261276942652323967835559474","211364815091471671335292792811151251480","146709269129839664605757152539845208149","248286803577515758494005552179336900362","229961056944906683896744944850171760495","218499929594801873617902212803100804529","277685718875055145822524010164517135514"],"threshold":0.9},"id":"CVE-2016-6254-308dc073"},{"digest":{"function_hash":"182876792119635883406710209722823110113","length":4959},"id":"CVE-2016-6254-c3386361","signature_type":"Function","signature_version":"v1","source":"https://github.com/collectd/collectd/commit/b589096f907052b3a4da2b9ccc9b0e2e888dfc18","target":{"file":"src/network.c","function":"parse_packet"},"deprecated":false}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"}]}