CVE-2014-6262

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before 4.2.5 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted third argument to the rrdtool.graph function, aka ZEN-15415, a related issue to CVE-2013-2131.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-134

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.kb.cert.org/vuls/id/449452Third Party Advisory, US Government Resource
https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharingThird Party Advisory
https://github.com/oetiker/rrdtool-1.x/commit/64ed5314af1255ab6dded45f70b39cdeab5ae2ecPatch, Third Party Advisory
https://github.com/oetiker/rrdtool-1.x/commit/85261a013112e278c90224033f5b0592ee387786Patch, Third Party Advisory
https://github.com/oetiker/rrdtool-1.x/pull/532Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00000.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00003.htmlMailing List, Third Party Advisory
https://www.securityfocus.com/bid/71540Third Party Advisory, VDB Entry
http://www.kb.cert.org/vuls/id/449452Third Party Advisory, US Government Resource
https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharingThird Party Advisory
https://github.com/oetiker/rrdtool-1.x/commit/64ed5314af1255ab6dded45f70b39cdeab5ae2ecPatch, Third Party Advisory
https://github.com/oetiker/rrdtool-1.x/commit/85261a013112e278c90224033f5b0592ee387786Patch, Third Party Advisory
https://github.com/oetiker/rrdtool-1.x/pull/532Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00000.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00003.htmlMailing List, Third Party Advisory
https://www.securityfocus.com/bid/71540Third Party Advisory, VDB Entry

Timeline

Published: Feb 12, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-62684.9The evtchn_fifo_set_pending function in Xen 4.4.x allows local guest users to cause a denial of service (host crash) via vectors involving a CVE-2014-62695.0Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 allow remote attacker CVE-2014-62706.8Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is configured, allows remote attacker CVE-2014-62719.8GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attac CVE-2014-62727.5Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.1.5-beta allow conte CVE-2014-62736.8Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of servi CVE-2014-62747.5git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybri CVE-2014-62755.9FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default. If project w CVE-2014-62764.3schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenti CVE-2014-627710.0GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote att CVE-2014-62788.8GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote att CVE-2014-62804.3Multiple cross-site scripting (XSS) vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script or HTML vi