CVE-2014-0159

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:N/A:P

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://openafs.org/pages/security/OPENAFS-SA-2014-001.txtVendor Advisory
http://secunia.com/advisories/57779Permissions Required, Third Party Advisory
http://secunia.com/advisories/57832Permissions Required, Third Party Advisory
http://www.debian.org/security/2014/dsa-2899Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2014:244Broken Link
http://www.openafs.org/frameset/dl/openafs/1.6.7/ChangeLogIssue Tracking, Release Notes
http://openafs.org/pages/security/OPENAFS-SA-2014-001.txtVendor Advisory
http://secunia.com/advisories/57779Permissions Required, Third Party Advisory
http://secunia.com/advisories/57832Permissions Required, Third Party Advisory
http://www.debian.org/security/2014/dsa-2899Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2014:244Broken Link
http://www.openafs.org/frameset/dl/openafs/1.6.7/ChangeLogIssue Tracking, Release Notes

Timeline

Published: Apr 14, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-01607.5The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows rem CVE-2014-01615.9ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or CVE-2014-01626.0The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allow CVE-2014-01638.8Openshift has shell command injection flaws due to unsanitized data being passed into shell commands.CVE-2014-01642.1openshift-origin-broker-util, as used in Red Hat OpenShift Enterprise 1.2.7 and 2.0.5, uses world-readable permissions for the mcollective c CVE-2014-01654.0WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related CVE-2014-01666.4The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determi CVE-2014-01676.0The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not CVE-2014-01686.8Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for re CVE-2014-01696.5In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the security domain. This CVE-2014-01704.3Teiid before 8.4.3 and before 8.7 and Red Hat JBoss Data Virtualization 6.0.0 before patch 3 allows remote attackers to read arbitrary files CVE-2014-01715.0XML external entity (XXE) vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 pat