CVE-2014-4607: oberhumer liblzo2 Integer Overflow or Wraparound
CVSS: 8.8v3.1HighModified
AliasesMGASA-2014-0290MGASA-2014-0351MGASA-2014-0352MGASA-2014-0355MGASA-2014-0356MGASA-2014-0357MGASA-2014-0358MGASA-2014-0359MGASA-2014-0360MGASA-2014-0361MGASA-2014-0362MGASA-2014-0363MGASA-2014-0378RHSA-2014:0861UBUNTU-CVE-2014-4607USN-2300-1DEBIAN-CVE-2014-4607DLA-35-1DSA-2995-1openSUSE-SU-2024:10854-1openSUSE-SU-2024:11089-1
Published 12-02-2020Last modified 06-08-2024
Vulnerability summary
CVE-2014-4607 is a high (CVSS 8.8) Integer Overflow or Wraparound vulnerability in oberhumer liblzo2. EPSS estimates a 5.32% chance of exploitation in the next 30 days, higher than 92.5% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
5.32%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 12-02-2020PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to execute arbitrary code via a crafted Literal Run.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
5.32%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 5.32% on 19-09-2026
19-09-202619-10-2026
EPSS score5.32%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (blog.securitymouse.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Mageia27 products
- blender< 2.65a-5.1.mga3
- busybox< 1.20.2-2.2.mga3
- distcc< 3.2rc1-3.1.mga3
- dump< 0.4b44-2.1.mga3
- grub2< 2.00-46.3.mga3
Ubuntu5 products
- grub2< 2.04-1ubuntu26.8
- grub2-signed< 1.142.10
- grub2-unsigned< 2.04-1ubuntu47.4
- krfb< 4:4.13.0-0ubuntu1.1
- lzo2< 2.06-1.2ubuntu1.1
Redhat4 products
- lzo< 0:2.03-3.1.el6_5.1 | < 0:2.06-6.el7_0.2
- lzo-debuginfo< 0:2.03-3.1.el6_5.1 | < 0:2.06-6.el7_0.2
- lzo-devel< 0:2.03-3.1.el6_5.1 | < 0:2.06-6.el7_0.2
- lzo-minilzo< 0:2.03-3.1.el6_5.1 | < 0:2.06-6.el7_0.2
Debian2 products
- busybox< 1:1.22.0-10
- lzo2< 2.08-1 | < 2.03-2+deb6u1 | < 2.06-1+deb7u1
Opensuse2 products
- icecream&distro=openSUSE Tumbleweed< 1.3.1-3.7
- nfdump&distro=openSUSE Tumbleweed< 1.6.23-1.3
6 vendors · 42 products
References
47 links- blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.htmlX Refsource MISCExploitThird Party Advisory
- web.archive.org/web/20140701023922/http://www.oberhumer.com/opensource/lzo/X Refsource CONFIRMVendor Advisory
