Lucene search

MitreCVE-2014-8625

HistoryJan 20, 2015 - 3:59 p.m.

CVE-2014-8625

2015-01-2015:59:01

CWE-134

mitre

web.nvd.nist.gov

cve-2014-8625

format string

dpkg

parse_error_msg

vulnerability

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.8

Confidence

Low

EPSS

0.056

Percentile

93.4%

JSON

Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) package or (2) architecture name.

Affected configurations

Nvd

Node

debiandpkgRange≤1.17.21

VendorProductVersionCPE
debiandpkg*cpe:2.3:a:debian:dpkg:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
debian	dpkg	*	cpe:2.3:a:debian:dpkg::::::::

References

lists.fedoraproject.org/pipermail/package-announce/2015-May/157387.html

seclists.org/oss-sec/2014/q4/539

seclists.org/oss-sec/2014/q4/551

seclists.org/oss-sec/2014/q4/622

bugs.debian.org/cgi-bin/bugreport.cgi?bug=768485

bugs.launchpad.net/ubuntu/+source/dpkg/+bug/1389135

exchange.xforce.ibmcloud.com/vulnerabilities/98551

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.8

Confidence

Low

EPSS

0.056

Percentile

93.4%

JSON

Related for CVE-2014-8625