CVE-2014-8484: canonical ubuntu_linux

CVSS: 5.0v2.0MediumModified

AliasesUBUNTU-CVE-2014-8484DEBIAN-CVE-2014-8484

Published 09-12-2014Last modified 06-08-2024

Vulnerability summary

CVE-2014-8484 is a medium (CVSS 5.0) vulnerability in canonical ubuntu_linux. EPSS estimates a 5.08% chance of exploitation in the next 30 days, higher than 92.2% of scored vulnerabilities.

Overall risk

21/100

0100

Low · default modelHow is this calculated?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

5.08%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 1

DLA-184-1 DSA-3123-1 DSA-3123-2 MGASA-2015-0027 RHSA-2015:2079 USN-2496-1

Timeline

09-12-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before 2.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a small S-record.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

5.08%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

0.00 pp

From 5.08% on 18-09-2026

18-09-202618-10-2026

EPSS score

5.08%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Debian2 products

binutils< 2.24.51.20140903-1
binutils-mingw-w64< 5.2

Canonical1 product

ubuntu_linuxEOL10.04 | 12.04 | 14.04 | 14.10

Fedoraproject1 product

fedoraEOL19 | 20 | 21

Gnu1 product

binutils≤ 2.24

Ubuntu1 product

binutils< 2.24-5ubuntu3.1

5 vendors · 6 products

References

22 links

secunia.com/advisories/62241Third Party AdvisoryX Refsource SECUNIAPermissions Required
www.mandriva.com/security/advisories?name=MDVSA-2015:029Vendor AdvisoryX Refsource MANDRIVABroken Link
www.ubuntu.com/usn/USN-2496-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2014-December/145328.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
openwall.com/lists/oss-security/2014/10/23/5Mailing ListX Refsource MLISTREPORT
www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlX Refsource CONFIRM
sourceware.org/bugzilla/show_bug.cgi?id=17509X Refsource CONFIRMIssue Tracking
www.securityfocus.com/bid/70714VDB EntryX Refsource BID
www.openwall.com/lists/oss-security/2014/10/26/2Mailing ListX Refsource MLISTThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=1156272X Refsource CONFIRMBroken Link

Show all 22 references

lists.fedoraproject.org/pipermail/package-announce/2014-December/145262.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
secunia.com/advisories/62746Third Party AdvisoryX Refsource SECUNIAPermissions Required
lists.fedoraproject.org/pipermail/package-announce/2014-December/145742.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
sourceware.org/git/?p=binutils-gdb.git%3Ba=commit%3Bh=bd25671c6f202c4a5108883caa2adb24ff6f361fX Refsource CONFIRM
security.gentoo.org/glsa/201612-24Vendor AdvisoryX Refsource GENTOO
ubuntu.com/security/CVE-2014-8484REPORT
openwall.com/lists/oss-security/2014/10/23/4REPORT
www.openwall.com/lists/oss-security/2014/10/26REPORT
openwall.com/lists/oss-security/2014/10/26/2REPORT
ubuntu.com/security/notices/USN-2496-1Advisory
www.cve.org/CVERecord?id=CVE-2014-8484REPORT
security-tracker.debian.org/tracker/CVE-2014-8484Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities