Remote Code Execution (RCE)

🗓️ 11 Dec 2020 09:20:29Reported by Veracode Vulnerability DatabaseType

veracode

veracode🔗 sca.analysiscenter.veracode.com👁 30 Views

krfb RCE due to integer overflow in LZO algorith

Reporter	Title	Published	Views	Family All 186
IBM Security Bulletins	Security Bulletin: WebSphere Cast Iron and App Connect Professional are affected by vulnerabilities in busybox, arpwatch, apr, acpid, augeas, firefox, ctdb.	15 Dec 202107:41	–	ibm
IBM Security Bulletins	IBM Security Network Protection / IBM QRadar Network Security / XGS Technote Index	31 Jan 202100:10	–	ibm
IBM Security Bulletins	Security Bulletin: A busybox vulnerability affects IBM DataPower Gateways (CVE-2014-4607)	15 Jun 201807:06	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in busybox affect IBM Security Network Protection (CVE-2014-4607, and CVE-2014-9645 )	16 Jun 201821:46	–	ibm
Amazon	Medium: lzo	9 Jul 201400:00	–	amazon
Tenable Nessus	Amazon Linux AMI : lzo (ALAS-2014-373)	12 Oct 201400:00	–	nessus
Tenable Nessus	CentOS 6 / 7 : lzo (CESA-2014:0861)	10 Jul 201400:00	–	nessus
Tenable Nessus	Debian DLA-2559-1 : busybox security update	16 Feb 202100:00	–	nessus
Tenable Nessus	Debian DLA-35-1 : lzo2 security update	26 Mar 201500:00	–	nessus
Tenable Nessus	Debian DSA-2995-1 : lzo2 - security update	4 Aug 201400:00	–	nessus

Vulners

Node

trusty trustyMatch4:4.13.0-0ubuntu1debian

AND

debian debian_linux

OR

focal focalMatch2.04-1ubuntu26.7debian

AND

focal focalMatch2.04-1ubuntu26debian

AND

focal focalMatch2.04-1ubuntu26.4debian

AND

focal focalMatch2.04-1ubuntu26.2debian

AND

debian debian_linux

OR

devel develMatch2.04-1ubuntu36debian

AND

devel develMatch2.04-1ubuntu28debian

AND

devel develMatch2.04-1ubuntu34debian

AND

devel develMatch2.04-1ubuntu30debian

AND

debian debian_linux

OR

apache groovyMatch2.04-1ubuntu30debian

AND

apache groovyMatch2.04-1ubuntu34debian

AND

apache groovyMatch2.04-1ubuntu35debian

AND

apache groovyMatch2.04-1ubuntu28debian

AND

apache groovyMatch2.04-1ubuntu35.1debian

AND

debian debian_linux

OR

hirsute hirsuteMatch2.04-1ubuntu36debian

AND

debian debian_linux

Source	Link
git	www.git.launchpad.net/ubuntu-cve-tracker/tree/active/CVE-2014-4607
blog	www.blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html
web	www.web.archive.org/web/20140701023922/http://www.oberhumer.com/opensource/lzo/

19 Apr 2022 18:46Current

4.8Medium risk

Vulners AI Score4.8

CVSS 26.8

CVSS 3.18.8

EPSS0.11033

krfb remote code execution integer overflow lzo algorithm oberhumer liblzo2