sysstat-12.6.1

[Douglas R. Reno]

New point version

Currency script reports 12.7.1, but that's a development release

Contains a fix for CVE-2022-39377

[Douglas R. Reno]

CVE-2022-39377 is described as remote code execution.

[Douglas R. Reno]

2022/11/06: Version 12.6.1 - Sebastien Godard (sysstat <at> orange.fr)
	* Fix possible overflow in sa_common.c (GHSL-2022-074).
	* sa_conv.c: Make size of statistics structures from older sysstat
	  versions immutable.
	* [Bernhard M. Wiedemann]: Declare sadc dependency on libsyscom.a.
	* [Steve Kay]: Fix gcc v11.2 warnings.
	* [Steve Kay]: Various cosmetic fixes.
	* [Jan Christoph Uhde]: sar: Remove `-I int_list` from man-page and
	  help.
	* [Frank Dana]: Consolidate systemctl commands in README file.
	* [Rong Tao]: Remove whitespace characters at the end of lines.

[Douglas R. Reno]

NOTE: This vulnerability is only exploitable on 32-bit systems

GitHub Security Advisory

---

Summary

On 32 bit systems, an arithmetic overflow present in allocate_structures can be triggered when displaying activity data files and may lead to a variety of exploit primitives due to an incorrectly sized buffer. Details

Issue: size_t overflow in sa_common.c (GHSL-2022-074)

allocate_structures function located in sa_common.c insufficiently checks bounds before arithmetic multiplication ([1]) allowing for an overflow in the size allocated for the buffer representing system activities.

Impact

This issue may lead to Remote Code Execution (RCE)

[Douglas R. Reno]

Fixed at eb07735db793496b46b7713213aa658b9139212b