CVE-2014-8504: canonical ubuntu_linux

CVSS: 7.5v2.0HighModified

AliasesUBUNTU-CVE-2014-8504DEBIAN-CVE-2014-8504

Published 09-12-2014Last modified 06-08-2024

Vulnerability summary

CVE-2014-8504 is a high (CVSS 7.5) vulnerability in canonical ubuntu_linux. EPSS estimates a 6.20% chance of exploitation in the next 30 days, higher than 93.4% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk

41/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

6.20%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits3reference

Advisory lineage

Upstream 0 · Downstream 6 · Related 1

DLA-184-1 DSA-3123-1 DSA-3123-2 MGASA-2015-0027 RHSA-2015:2079 USN-2496-1

Timeline

09-12-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted file.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

6.20%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

0.00 pp

From 6.20% on 18-09-2026

18-09-202618-10-2026

EPSS score

6.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

referenceUnverified
Exploit Reference (sourceware.org)
Maturity: unknown
referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown
referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Debian2 products

binutils< 2.24.90.20141104-1
binutils-mingw-w64< 5.2

Canonical1 product

ubuntu_linuxEOL10.04 | 12.04 | 14.04 | 14.10

Fedoraproject1 product

fedoraEOL19 | 20 | 21

Gnu1 product

binutils≤ 2.24

Ubuntu1 product

binutils< 2.24-5ubuntu3.1

5 vendors · 6 products

References

25 links

bugzilla.redhat.com/show_bug.cgi?id=1162621X Refsource CONFIRMIssue Tracking
secunia.com/advisories/62241Third Party AdvisoryX Refsource SECUNIAPermissions Required
sourceware.org/bugzilla/show_bug.cgi?id=17510X Refsource CONFIRMExploitIssue Tracking
www.mandriva.com/security/advisories?name=MDVSA-2015:029Vendor AdvisoryX Refsource MANDRIVABroken Link
www.ubuntu.com/usn/USN-2496-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2014-December/145328.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.openwall.com/lists/oss-security/2014/10/27/5Mailing ListX Refsource MLISTExploitThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-January/147346.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2014-December/145262.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-January/148427.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory

Show all 25 references

secunia.com/advisories/62746Third Party AdvisoryX Refsource SECUNIAPermissions Required
www.openwall.com/lists/oss-security/2014/10/27/4Mailing ListX Refsource MLISTExploitThird Party Advisory
www.openwall.com/lists/oss-security/2014/10/31/1Mailing ListX Refsource MLISTThird Party Advisory
sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=708d7d0d11f0f2d776171979aa3479e8e12a38a0X Refsource CONFIRM
lists.fedoraproject.org/pipermail/package-announce/2014-December/145742.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-January/147354.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.securityfocus.com/bid/70761VDB EntryX Refsource BIDThird Party Advisory
security.gentoo.org/glsa/201612-24Vendor AdvisoryX Refsource GENTOO
ubuntu.com/security/CVE-2014-8504REPORT
openwall.com/lists/oss-security/2014/10/27/4REPORT
openwall.com/lists/oss-security/2014/10/27/5REPORT
www.openwall.com/lists/oss-security/2014/10/31REPORT
ubuntu.com/security/notices/USN-2496-1Advisory
www.cve.org/CVERecord?id=CVE-2014-8504REPORT
security-tracker.debian.org/tracker/CVE-2014-8504Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities