CVE-2014-2386

Icinga < 1.10.2 - Denial of Service via Stack-Based Buffer Overflow in CGI Functions

Title source: llm
STIX 2.1

Description

Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to cause a denial of service (crash) via unspecified vectors to the (1) display_nav_table, (2) print_export_link, (3) page_num_selector, or (4) page_limit_selector function in cgi/cgiutils.c or (5) status_page_num_selector function in cgi/status.c, which triggers a stack-based buffer overflow.

References (4)

Core 4
Core References
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-03/msg00072.html
Issue Tracking x_refsource_confirm
https://dev.icinga.org/issues/5663
Various Sources mailing-list x_refsource_mlist
http://comments.gmane.org/gmane.comp.security.oss.general/12355

Scores

EPSS 0.0276
EPSS Percentile 84.6%

Details

CWE
CWE-189
Status published
Products (5)
icinga/icinga 1.10.0
icinga/icinga 1.10.1
icinga/icinga < 1.10.2
opensuse/opensuse 12.3
opensuse/opensuse 13.1
Published Mar 25, 2014
Tracked Since Feb 18, 2026