10

CVE-2014-2523: canonical ubuntu_linux Improper Input Validation

Modified
AliasesUBUNTU-CVE-2014-2523DEBIAN-CVE-2014-2523
Published 24-03-2014Last modified 06-08-2024

Vulnerability summary

CVE-2014-2523 is a high (CVSS 10.0) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 10.38% chance of exploitation in the next 30 days, higher than 95.7% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 10, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
10.0/10
010
High · v2.0 (NVD)
EPSS score
10.38%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6
DSA-2906-1RHSA-2014:0439RHSA-2014:0475RHSA-2014:0520RHSA-2014:0593RHSA-2014:0634

Timeline

  1. 24-03-2014
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointer incorrectly, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a DCCP packet that triggers a call to the (1) dccp_new, (2) dccp_packet, or (3) dccp_error function.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

10.38%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 10.38% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Ubuntu10 products
  • linux< 3.13.0-20.42 | < 4.2.0-16.19
  • linux-aws< 4.4.0-1002.2 | < 4.4.0-1001.10
  • linux-gke< 4.4.0-1003.3
  • linux-hwe< 4.8.0-36.36~16.04.1
  • linux-lts-utopic< 3.16.0-25.33~14.04.2
Canonical1 product
Debian1 product
  • linux< 3.13.10-1
Linux1 product
  • linux_kernel< 3.2.57 | ≥ 3.3, < 3.4.86 | ≥ 3.5, < 3.10.36 | ≥ 3.11, < 3.12.17 | ≥ 3.13.0, < 3.13.9

4 vendors · 13 products

References

23 links
Show all 23 references