Qualys TRU Discovers Important Vulnerabilities in GNU C Library’s syslog()

Qualys Threat Research Unit disclosed multiple serious vulnerabilities in the GNU C Library, most notably a heap-based buffer overflow in __vsyslog_internal (CVE-2023-6246) allowing local privilege escalation to root on many Linux distributions, two additional lesser syslog issues (CVE-2023-6779, CVE-2023-6780), and a qsort() memory corruption due to a missing bounds check; patches and coordinated disclosure details are provided along with Qualys detection and QID coverage.