CVE-2014-1690

LowCVSS 2.6/10Last modified Jun 17, 2026

Description

The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect packet data is transmitted during use of the NAT mangle feature.

Metrics

CVSS 2.0 2.6/10AV:N/AC:H/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2690d97ade05c5325cbf7c72b94b90d265659886
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8Mailing List, Patch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2014/01/28/3Mailing List, Patch, Third Party Advisory
http://www.ubuntu.com/usn/USN-2137-1Third Party Advisory
http://www.ubuntu.com/usn/USN-2140-1Third Party Advisory
http://www.ubuntu.com/usn/USN-2158-1Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1058748Issue Tracking, Patch, Third Party Advisory
https://github.com/torvalds/linux/commit/2690d97ade05c5325cbf7c72b94b90d265659886Exploit, Patch, Third Party Advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2690d97ade05c5325cbf7c72b94b90d265659886
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8Mailing List, Patch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2014/01/28/3Mailing List, Patch, Third Party Advisory
http://www.ubuntu.com/usn/USN-2137-1Third Party Advisory
http://www.ubuntu.com/usn/USN-2140-1Third Party Advisory
http://www.ubuntu.com/usn/USN-2158-1Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1058748Issue Tracking, Patch, Third Party Advisory
https://github.com/torvalds/linux/commit/2690d97ade05c5325cbf7c72b94b90d265659886Exploit, Patch, Third Party Advisory

Timeline

Published: Feb 28, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-16917.5The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object inject CVE-2014-16927.3The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initiali CVE-2014-16937.5Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP com CVE-2014-16946.8Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketPr CVE-2014-16954.3Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3 CVE-2014-16965.0Siemens SIMATIC WinCC OA before 3.12 P002 January uses a weak hash algorithm for passwords, which makes it easier for remote attackers to ob CVE-2014-16977.5The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted CVE-2014-16985.0Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via c CVE-2014-16995.0Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service (monitoring-service outage) via malfo CVE-2014-17007.5Use-after-free vulnerability in modules/speech/SpeechSynthesis.cpp in Blink, as used in Google Chrome before 33.0.1750.149, allows remote at CVE-2014-17014.3The GenerateFunction function in bindings/scripts/code_generator_v8.pm in Blink, as used in Google Chrome before 33.0.1750.149, does not imp CVE-2014-17027.5Use-after-free vulnerability in the DatabaseThread::cleanupDatabaseThread function in modules/webdatabase/DatabaseThread.cpp in the web data