CVE-2014-9273 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Hivex

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-120 — Classic Buffer Overflow9 documents7 sources
Severity
4.6MEDIUMNVD
EPSS
0.2%
top 60.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Redhat HivexDebian HivexOpensuse+4 more
Timeline
PublishedDec 8
Latest updateMay 14

Description

lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.

CVSS vector

AV:L/AC:L/C:P/I:P/A:PExploitability: 3.9 | Impact: 6.4

Affected Packages7 packages

▶Debianredhat/hivex< 1.3.11-1+3
▶NVDdebian/hivex1.3.10-2
▶NVDopensuse/opensuse13.1, 13.2+1

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-qvqq-v774-hxcg: lib/handle↗2022-05-14
▶
CVEList
CVE-2014-9273: lib/handle↗2014-12-08
▶
OSV
CVE-2014-9273: lib/handle↗2014-12-08
▶

📋Vendor Advisories

2
Red Hat
hivex: missing checks for small-sized files↗2014-10-29
▶
Debian
CVE-2014-9273: hivex - lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code...↗2014
▶

💬Community

3
Bugzilla
CVE-2014-9273 hivex: missing checks for small-sized files↗2014-11-25
▶
Bugzilla
CVE-2014-9273 hivex: missing checks for small/truncated files [rhel-6.7]↗2014-10-30
▶
Bugzilla
CVE-2014-9273 hivex: missing checks for small-sized files [rhel-7.1]↗2014-10-30
▶
CVE-2014-9273 — Debian Hivex vulnerability | cvebase