CVE-2014-4043: gnu glibc Improper Control of Generation of Code
Vulnerability summary
CVE-2014-4043 is a high (CVSS 7.5) Improper Control of Generation of Code vulnerability in gnu glibc. EPSS estimates a 3.92% chance of exploitation in the next 30 days, higher than 90.3% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 2Timeline
- 06-10-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
3.92%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.92% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (bugzilla.redhat.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- glibc< 2.19-2
Gnu1 product
- glibc≤ 2.19
Opensuse1 product
- opensuseEOL13.1
Ubuntu1 product
- eglibc< 2.19-0ubuntu6.1
4 vendors · 4 products
References
21 links- sourceware.org/git/…X Refsource CONFIRM
- sourceware.org/bugzilla/show_bug.cgi?id=17048X Refsource CONFIRM
- sourceware.org/git/…X Refsource CONFIRM
Show all 21 references
- packetstormsecurity.com/files/…X Refsource MISC
