Vulnerability Details : CVE-2014-8625
Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) package or (2) architecture name.
Vulnerability category: OverflowExecute codeDenial of service
Products affected by CVE-2014-8625
- cpe:2.3:a:debian:dpkg:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-8625
5.59%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 93 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-8625
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2014-8625
-
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-8625
-
http://seclists.org/oss-sec/2014/q4/539
oss-sec: CVE-Request: dpkg handling of 'control' and warnings format string vulnerabilityExploit
-
https://bugs.launchpad.net/ubuntu/+source/dpkg/+bug/1389135
Bug #1389135 “dpkg / dpkg-deb segfault -- possible format string... : Bugs : dpkg package : UbuntuExploit
-
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=768485
#768485 - dpkg: CVE-2014-8625: format string vulnerability - Debian Bug report logsExploit
-
http://seclists.org/oss-sec/2014/q4/622
oss-sec: Re: CVE-Request: dpkg handling of 'control' and warnings format string vulnerability
-
http://seclists.org/oss-sec/2014/q4/551
oss-sec: Re: CVE-Request: dpkg handling of 'control' and warnings format string vulnerability
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157387.html
[SECURITY] Fedora 22 Update: dpkg-1.16.16-5.fc22
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/98551
dpkg format string CVE-2014-8625 Vulnerability Report
Jump to