Enrico Zini discovered a buffer overflow in log2mail, a daemon for watching logfiles and sending lines with matching patterns via mail. The log2mail daemon is started upon system boot and runs as root. A specially crafted (remote) log message could overflow a static buffer, potentially leaving log2mail to execute arbitrary code as root.
This problem has been fixed in version 0.2.5.1 the current stable distribution (woody) and in version 0.2.6-1 for the unstable distribution (sid). The old stable distribution (potato) is not affected since it doesn't contain a log2mail package.
We recommend that you upgrade your log2mail package.
MD5 checksums of the listed files are available in the original advisory.