CVE-2014-3677

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2014-1801.htmlBroken Link
http://www.openwall.com/lists/oss-security/2014/10/13/4Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/70410Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/96989Third Party Advisory, VDB Entry
http://rhn.redhat.com/errata/RHSA-2014-1801.htmlBroken Link
http://www.openwall.com/lists/oss-security/2014/10/13/4Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/70410Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/96989Third Party Advisory, VDB Entry

Timeline

Published: Oct 22, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-36784.3Cross-site scripting (XSS) vulnerability in the Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to inject arbitrary web CVE-2014-36795.0The Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to obtain sensitive information by accessing unspecified pages.CVE-2014-36804.0Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for t CVE-2014-36814.3Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web scri CVE-2014-36827.5XML external entity (XXE) vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java in jbpm-CVE-2014-36835.0Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of serv CVE-2014-36846.8The tm_adopt function in lib/Libifl/tm.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 5.0.x, 4.5.x, 4.2 CVE-2014-36866.8wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts,CVE-2014-36877.5The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remot CVE-2014-36885.0The SCTP implementation in the Linux kernel before 3.17.4 allows remote attackers to cause a denial of service (memory consumption) by trigg CVE-2014-36897.2The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via u CVE-2014-36905.5arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 cont