CVE-2014-6262 Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before 4.2.5 and other products, allow remote attackers to execute arbitrary code or cause a denial of se...
HighCVSS 7.5
EPSS 7.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before 4.2.5 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted third argument to the rrdtool.graph function, aka ZEN-15415, a related issue to CVE-2013-2131.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/rrdtool(Debian:12) | < 1.5.4-1 | 1.5.4-1 |
| debian/rrdtool(Debian:13) | < 1.5.4-1 | 1.5.4-1 |
| debian/rrdtool(Debian:14) | < 1.5.4-1 | 1.5.4-1 |
| zenoss core | < 4.2.5 | 4.2.5 |
| debian linux | = 8.0 | No fix listed |
References
- Debian Security Tracker CVE-2014-6262 vendor-advisory
- www.kb.cert.org third-party-advisory us-government-resource
- docs.google.com third-party-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- github.com third-party-advisory
- [debian-lts-announce] 20200301 [SECURITY] [DLA 2131-1] rrdtool security update mailing-list third-party-advisory
- [debian-lts-announce] 20200302 [SECURITY] [DLA 2131-2] rrdtool regression update mailing-list third-party-advisory
- www.securityfocus.com third-party-advisory vdb-entry