Double free vulnerability in the prepare_exec function in src/exec.c in Logsurfer 1.5b and earlier, and Logsurfer+ 1.7 and earlier, allows remote attackers to execute arbitrary commands via crafted strings in a log file.
| Software | From | Fixed in |
|---|---|---|
| drusus / logsurfer | 1.4 | 1.4.x |
| drusus / logsurfer | 1.2 | 1.2.x |
| drusus / logsurfer | 1.1 | 1.1.x |
| drusus / logsurfer | 1.5-beta2 | 1.5-beta2.x |
| drusus / logsurfer | 1.5a | 1.5a.x |
| drusus / logsurfer | 1.3 | 1.3.x |
| drusus / logsurfer | 1.41 | 1.41.x |
| drusus / logsurfer | - | 1.5b.x |
| drusus / logsurfer | 1.5 | 1.5.x |
| drusus / logsurfer | 1.5-beta | 1.5-beta.x |
| kerry_thompson / logsurfer+ | - | 1.7.x |
| kerry_thompson / logsurfer+ | 1.6 | 1.6.x |
| kerry_thompson / logsurfer+ | 1.5a | 1.5a.x |
| kerry_thompson / logsurfer+ | 1.6a | 1.6a.x |
| kerry_thompson / logsurfer+ | 1.6b | 1.6b.x |
| kerry_thompson / logsurfer+ | 1.5b | 1.5b.x |