CVE-2014-9474 Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context-dependent attackers to have unspecified impact via vectors related to incorrect documentation for mpn_set_str.
CriticalCVSS 9.8
EPSS 4.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context-dependent attackers to have unspecified impact via vectors related to incorrect documentation for mpn_set_str.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mpfr4(Debian:12) | < 3.1.2-2 | 3.1.2-2 |
| debian/mpfr4(Debian:13) | < 3.1.2-2 | 3.1.2-2 |
| debian/mpfr4(Debian:14) | < 3.1.2-2 | 3.1.2-2 |
| mpfr gnu mpfr | <= 3.1.2 | No fix listed |
References
- Debian Security Tracker CVE-2014-9474 vendor-advisory
- FEDORA-2014-16967 third-party-advisory vendor-advisory
- FEDORA-2014-16964 third-party-advisory vendor-advisory
- www.mpfr.org vendor-advisory
- [oss-security] 20150103 Re: CVE request: mpfr: buffer overflow in mpfr_strtofr mailing-list third-party-advisory
- 71542 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking third-party-advisory
- gforge.inria.fr third-party-advisory
- [gmp-bugs] 20131216 out-of-bound write mailing-list not-applicable
- GLSA-201512-06 third-party-advisory vendor-advisory
- bugs.debian.org issue-tracking