CVE-2014-8182

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If slapd was configured to use the dnssrv backend, an attacker could crash the service with crafted DNS responses.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-193

Affected software

Vendor	Product	Versions
openldap	openldap	2.4

References

https://access.redhat.com/security/cve/cve-2014-8182Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8182Exploit, Issue Tracking, Patch, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-8182Exploit, Issue Tracking, Patch, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2014-8182Patch, Third Party Advisory
https://access.redhat.com/security/cve/cve-2014-8182Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8182Exploit, Issue Tracking, Patch, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-8182Exploit, Issue Tracking, Patch, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2014-8182Patch, Third Party Advisory

Timeline

Published: Jan 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-81837.4It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An at CVE-2014-81847.8A vulnerability was found in liblouis, versions 2.5.x before 2.5.4. A stack-based buffer overflow was found in findTable() in liblouis. An a CVE-2014-82407.5Integer overflow in TigerVNC allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via vectors CVE-2014-82419.8XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a mallo CVE-2014-82425.8librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for remote attackers to modify transmitted data v CVE-2014-82433.3Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 1625 CVE-2014-82447.5Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 1625 CVE-2014-82466.8Cross-site request forgery (CSRF) vulnerability in CA Release Automation (formerly iTKO LISA Release Automation) before 4.7.1 b448 allows re CVE-2014-82474.3Cross-site scripting (XSS) vulnerability in CA Release Automation (formerly iTKO LISA Release Automation) before 4.7.1 b448 allows remote at CVE-2014-82486.5SQL injection vulnerability in CA Release Automation (formerly iTKO LISA Release Automation) before 4.7.1 b448 allows remote authenticated u CVE-2014-82664.3Multiple cross-site scripting (XSS) vulnerabilities in the note-creation page in QPR Portal 2014.1.1 and earlier allow remote attackers to i CVE-2014-82674.3Cross-site scripting (XSS) vulnerability in QPR Portal 2014.1.1 and earlier allows remote attackers to inject arbitrary web script or HTML v