CVE-2015-8954

Suricata before versions 8.0.3 and 7.0.14 contains an unsigned integer overflow that can lead to a heap use-after-free condition when generating excessive amounts of alerts for a single packet. The issue is fixed in versions 8.0.3 and 7.0.14.

Suricata, a network IDS, IPS and NSM engine, can crash with a stack overflow. The vulnerability affects versions from 8.0.0 up to 8.0.2, and version 8.0.3 patches the issue.

Suricata before versions 8.0.3 and 7.0.14 has a vulnerability to excessive memory consumption while parsing DNP3 traffic. Specially crafted traffic can slow down the process and lead to memory exhaustion, potentially causing the process to be killed by the OOM killer.

Suricata before versions 8.0.3 and 7.0.14 has a vulnerability that allows crafted DCERPC traffic to cause unbounded buffer expansion, leading to memory exhaustion and process termination. The issue affects DCERPC over UDP and likely also over TCP and SMB. Patches are available in versions 8.0.3 and 7.0.14.

In Suricata before version 4.x, it was possible to trigger many redundant checks on the content of crafted network traffic due to a bug in DetectEngineContentInspection. The search engine did not stop when no match was found, leading to exceeding the inspection recursion limit.

Suricata before version 3.2.1 has an IPv4 defragmentation evasion issue caused by lack of a check for the IP protocol during fragment matching.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a protocol change while processing HTTP/2 traffic could lead to type confusion, causing Suricata to crash and resulting in denial of service.

In Suricata before version 6.0.13, an adversary controlling an external source of Lua rules may be able to execute Lua code. This issue is addressed in version 6.0.13 by disabling Lua unless the allow-rules option is set to true in the Lua security configuration section.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From version 8.0.0 to 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua sandbox. This requires an affected Lua script or rule to be loaded.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, IKEv2 parser state could grow without bounds while storing client transforms. Repeated crafted UDP traffic may cause Suricata to consume excessive memory.