CVE-2014-8104

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet.

Metrics

CVSS 2.0 6.8/10AV:N/AC:L/Au:S/C:N/I:N/A:C

Weakness enumeration

CWE-399

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://advisories.mageia.org/MGASA-2014-0512.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00008.htmlThird Party Advisory
http://www.debian.org/security/2014/dsa-3084Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:139Broken Link
http://www.ubuntu.com/usn/USN-2430-1Third Party Advisory
https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732bVendor Advisory
http://advisories.mageia.org/MGASA-2014-0512.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00008.htmlThird Party Advisory
http://www.debian.org/security/2014/dsa-3084Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:139Broken Link
http://www.ubuntu.com/usn/USN-2430-1Third Party Advisory
https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732bVendor Advisory

Timeline

Published: Dec 3, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-81055.0389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which CVE-2014-81064.6Heap-based buffer overflow in the Cirrus VGA emulator (hw/display/cirrus_vga.c) in QEMU before 2.2.0 allows local guest users to execute arb CVE-2014-81085.0The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause CVE-2014-81094.3mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which th CVE-2014-81104.3Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remot CVE-2014-81115.0Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attacker CVE-2014-81124.0389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed CVE-2014-81146.8The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to (1) execute arbitrary code by uploading craf CVE-2014-81156.5The default authorization constrains in KIE Workbench 6.0.x allows remote authenticated users to read or write to arbitrary files, bypass in CVE-2014-81165.0The ELF parser (readelf.c) in file before 5.21 allows remote attackers to cause a denial of service (CPU consumption or crash) via a large n CVE-2014-81175.0softmagic.c in file before 5.21 does not properly limit recursion, which allows remote attackers to cause a denial of service (CPU consumpti CVE-2014-811810.0Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section