{
  "document": {
    "aggregate_severity": {
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      },
      {
        "category": "details",
        "text": "CVE-2022-39377: size_t overflow in allocate_structures (sa_common.c) may cause buffer overflow leading to RCE\n- CVE-2023-33204: integer overflow in check_overflow (common.c) - incomplete fix for CVE-2022-39377",
        "title": "Details"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1777539688",
        "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1777539688"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux7els/advisories/2026/clsa-2026_1777539688.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-04-30T09:02:07Z",
      "generator": {
        "date": "2026-04-30T09:02:07Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CLSA-2026:1777539688",
      "initial_release_date": "2026-04-30T09:02:07Z",
      "revision_history": [
        {
          "date": "2026-04-30T09:02:07Z",
          "number": "1",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1"
    },
    "title": "sysstat: Fix of 2 CVEs"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Oracle Linux 7",
                "product": {
                  "name": "Oracle Linux 7",
                  "product_id": "Oracle-Linux-7",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Oracle Linux"
          }
        ],
        "category": "vendor",
        "name": "Oracle Corporation"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "sysstat-0:10.1.5-20.0.3.el7_9.tuxcare.els1.x86_64",
                "product": {
                  "name": "sysstat-0:10.1.5-20.0.3.el7_9.tuxcare.els1.x86_64",
                  "product_id": "sysstat-0:10.1.5-20.0.3.el7_9.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/sysstat@10.1.5-20.0.3.el7_9.tuxcare.els1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sysstat-0:10.1.5-20.0.3.el7_9.tuxcare.els1.x86_64 as a component of Oracle Linux 7",
          "product_id": "Oracle-Linux-7:sysstat-0:10.1.5-20.0.3.el7_9.tuxcare.els1.x86_64"
        },
        "product_reference": "sysstat-0:10.1.5-20.0.3.el7_9.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Oracle-Linux-7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-33204",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Oracle-Linux-7:sysstat-0:10.1.5-20.0.3.el7_9.tuxcare.els1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2023-33204"
        },
        {
          "category": "external",
          "summary": "https://github.com/sysstat/sysstat/pull/360",
          "url": "https://github.com/sysstat/sysstat/pull/360"
        },
        {
          "category": "external",
          "summary": "https://lists.debian.org/debian-lts-announce/2023/05/msg00026.html",
          "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00026.html"
        },
        {
          "category": "external",
          "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7UUEKMNDMC6RZTI4O367ZD2YKCOX5THX/",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7UUEKMNDMC6RZTI4O367ZD2YKCOX5THX/"
        },
        {
          "category": "external",
          "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NUBFX3UNOSM7KFUIB3J32ASYT5ZRXJQV/",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NUBFX3UNOSM7KFUIB3J32ASYT5ZRXJQV/"
        },
        {
          "category": "external",
          "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00017.html",
          "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00017.html"
        }
      ],
      "release_date": "2023-05-18T08:15:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-30T09:01:30.799682Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1777539688",
          "product_ids": [
            "Oracle-Linux-7:sysstat-0:10.1.5-20.0.3.el7_9.tuxcare.els1.x86_64"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1777539688"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Oracle-Linux-7:sysstat-0:10.1.5-20.0.3.el7_9.tuxcare.els1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ]
    },
    {
      "cve": "CVE-2022-39377",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"
      },
      "notes": [
        {
          "category": "description",
          "text": "sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_structures contains a size_t overflow in sa_common.c. The allocate_structures function insufficiently checks bounds before arithmetic multiplication, allowing for an overflow in the size allocated for the buffer representing system activities. This issue may lead to Remote Code Execution (RCE). This issue has been patched in version 12.7.1.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Oracle-Linux-7:sysstat-0:10.1.5-20.0.3.el7_9.tuxcare.els1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2022-39377"
        },
        {
          "category": "external",
          "summary": "https://github.com/sysstat/sysstat/security/advisories/GHSA-q8r6-g56f-9w7x",
          "url": "https://github.com/sysstat/sysstat/security/advisories/GHSA-q8r6-g56f-9w7x"
        },
        {
          "category": "external",
          "summary": "https://lists.debian.org/debian-lts-announce/2022/11/msg00014.html",
          "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00014.html"
        },
        {
          "category": "external",
          "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6F26ALXWYHT4LN2AHPZM34OQEXTJE3JZ/",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6F26ALXWYHT4LN2AHPZM34OQEXTJE3JZ/"
        },
        {
          "category": "external",
          "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7X6WKTODOUDV6M3HZMASYNZP6EM4N7W4/",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7X6WKTODOUDV6M3HZMASYNZP6EM4N7W4/"
        },
        {
          "category": "external",
          "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHUVUDIVDJZ7AVXD3XX3NBXXXKPOKN3N/",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHUVUDIVDJZ7AVXD3XX3NBXXXKPOKN3N/"
        },
        {
          "category": "external",
          "summary": "https://security.gentoo.org/glsa/202211-07",
          "url": "https://security.gentoo.org/glsa/202211-07"
        },
        {
          "category": "external",
          "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00017.html",
          "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00017.html"
        }
      ],
      "release_date": "2022-11-08T20:15:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-30T09:01:30.799682Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1777539688",
          "product_ids": [
            "Oracle-Linux-7:sysstat-0:10.1.5-20.0.3.el7_9.tuxcare.els1.x86_64"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1777539688"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Oracle-Linux-7:sysstat-0:10.1.5-20.0.3.el7_9.tuxcare.els1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ]
    }
  ]
}