CVE catalog
CVE-2014-4607
busybox: CVE-2014-4607
- Severity
- High · CVSS 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 5.32% · Oct 27, 2026
Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to execute arbitrary code via a crafted Literal Run.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | lzo2 | sid | 2.10-3 | fixed |
| Debian | lzo2 | forky | 2.10-3 | fixed |
| Debian | lzo2 | trixie | 2.10-3 | fixed |
| Debian | lzo2 | bookworm | 2.10-2 | fixed |
| Debian | busybox | sid | 1:1.38.0-3 | fixed |
| Debian | busybox | forky | 1:1.38.0-3 | fixed |
| Debian | busybox | trixie | 1:1.37.0-6 | fixed |
| Debian | busybox | bookworm | 1:1.35.0-4+deb12u1 | fixed |
| Ubuntu | lzo2 | 14.04 | 2.06-1.2 | vulnerable |
| Ubuntu | lzo2 | 14.04 | 2.06-1.2ubuntu1 | vulnerable |
| Ubuntu | lzo2 | 14.04 | 2.06-1.2ubuntu1.1 | fixed |
| Ubuntu | krfb | 14.04 | 4:4.11.2-0ubuntu1 | vulnerable |
| Ubuntu | krfb | 14.04 | 4:4.11.80-0ubuntu1 | vulnerable |
| Ubuntu | krfb | 14.04 | 4:4.11.95-0ubuntu1 | vulnerable |
| Ubuntu | krfb | 14.04 | 4:4.11.97-0ubuntu1 | vulnerable |
| Ubuntu | krfb | 14.04 | 4:4.12.0-0ubuntu1 | vulnerable |
| Ubuntu | krfb | 14.04 | 4:4.12.1-0ubuntu1 | vulnerable |
| Ubuntu | krfb | 14.04 | 4:4.12.2-0ubuntu1 | vulnerable |
| Ubuntu | krfb | 14.04 | 4:4.12.3-0ubuntu1 | vulnerable |
| Ubuntu | krfb | 14.04 | 4:4.12.90-0ubuntu1 | vulnerable |
| Ubuntu | krfb | 14.04 | 4:4.12.95-0ubuntu1 | vulnerable |
| Ubuntu | krfb | 14.04 | 4:4.12.97-0ubuntu1 | vulnerable |
| Ubuntu | krfb | 14.04 | 4:4.13.0-0ubuntu1 | vulnerable |
| Ubuntu | krfb | 14.04 | 4:4.13.0-0ubuntu1.1 | fixed |
| Ubuntu | lzo2 | 14.04 | 2.06-1.2 | vulnerable |
| Ubuntu | lzo2 | 14.04 | 2.06-1.2ubuntu1 | vulnerable |
| Ubuntu | lzo2 | 14.04 | 2.06-1.2ubuntu1.1 | fixed |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu12 | vulnerable |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu13 | vulnerable |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu14 | vulnerable |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu16 | vulnerable |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu18 | vulnerable |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu20 | vulnerable |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu21 | vulnerable |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu22 | vulnerable |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu23 | vulnerable |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu24 | vulnerable |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu25 | vulnerable |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu26 | vulnerable |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu26.1 | vulnerable |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu26.2 | vulnerable |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu26.3 | vulnerable |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu26.4 | vulnerable |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu26.6 | vulnerable |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu26.7 | vulnerable |
| Ubuntu | grub2 | 20.04 | 2.04-1ubuntu26.8 | fixed |
| Ubuntu | grub2-signed | 20.04 | 1.128 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.129 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.130 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.131 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.133 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.134 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.135 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.136 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.137 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.138 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.139 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.140 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.141 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.142 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.142.1 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.142.3 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.142.4 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.142.5 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.142.6 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.142.8 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.142.9 | vulnerable |
| Ubuntu | grub2-signed | 20.04 | 1.142.10 | fixed |
| Ubuntu | grub2-unsigned | 20.04 | 2.04-1ubuntu44 | vulnerable |
| Ubuntu | grub2-unsigned | 20.04 | 2.04-1ubuntu44.2 | vulnerable |
| Ubuntu | grub2-unsigned | 20.04 | 2.04-1ubuntu47.4 | fixed |
| Opensuse | icecream | tumbleweed | 1.3.1-3.7 | fixed |
| Opensuse | nfdump | tumbleweed | 1.6.23-1.3 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | lzo2 | source | sid | 2.08-1 | not yet assigned | Not reported | [752861] |
| Debian | lzo2 | source | forky | 2.08-1 | not yet assigned | Not reported | [752861] |
| Debian | lzo2 | source | trixie | 2.08-1 | not yet assigned | Not reported | [752861] |
| Debian | lzo2 | source | bookworm | 2.08-1 | not yet assigned | Not reported | [752861] |
| Debian | busybox | source | sid | 1:1.22.0-10 | not yet assigned | Not reported | [768945] |
| Debian | busybox | source | forky | 1:1.22.0-10 | not yet assigned | Not reported | [768945] |
| Debian | busybox | source | trixie | 1:1.22.0-10 | not yet assigned | Not reported | [768945] |
| Debian | busybox | source | bookworm | 1:1.22.0-10 | not yet assigned | Not reported | [768945] |
| Ubuntu | lzo2 | deb | 14.04 | 2.06-1.2ubuntu1.1 | Not reported | USN-2300-1 | Not reported |
| Ubuntu | krfb | deb | 14.04 | 4:4.13.0-0ubuntu1.1 | Not reported | UBUNTU-CVE-2014-4607 | Not reported |
| Ubuntu | lzo2 | deb | 14.04 | 2.06-1.2ubuntu1.1 | Not reported | UBUNTU-CVE-2014-4607 | Not reported |
| Ubuntu | grub2 | deb | 20.04 | 2.04-1ubuntu26.8 | Not reported | UBUNTU-CVE-2014-4607 | Not reported |
| Ubuntu | grub2-signed | deb | 20.04 | 1.142.10 | Not reported | UBUNTU-CVE-2014-4607 | Not reported |
| Ubuntu | grub2-unsigned | deb | 20.04 | 2.04-1ubuntu47.4 | Not reported | UBUNTU-CVE-2014-4607 | Not reported |
| Opensuse | icecream | rpm | tumbleweed | 1.3.1-3.7 | Not reported | OPENSUSE-SU-2024:10854-1 | Not reported |
| Opensuse | nfdump | rpm | tumbleweed | 1.6.23-1.3 | Not reported | OPENSUSE-SU-2024:11089-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [icecream-clang-wrappers]Unknown
Source package: [icecream]
Details (1)
1.4.0-4.5· x86_64 · tumbleweedUnknown · Fixed:
1.3.1-3.7Version impact unknown
dsa · icecream · opensuse · tumbleweed
- [libicecream-devel]Unknown
Source package: [icecream]
Details (1)
1.4.0-4.5· x86_64 · tumbleweedUnknown · Fixed:
1.3.1-3.7Version impact unknown
dsa · icecream · opensuse · tumbleweed
- [libnfdump-1_7_8]Unknown
Source package: [nfdump]
Details (1)
1.7.8-1.3· x86_64 · tumbleweedUnknown · Fixed:
1.6.23-1.3Version impact unknown
dsa · nfdump · opensuse · tumbleweed
- [libnffile-1_7_8]Unknown
Source package: [nfdump]
Details (1)
1.7.8-1.3· x86_64 · tumbleweedUnknown · Fixed:
1.6.23-1.3Version impact unknown
dsa · nfdump · opensuse · tumbleweed
- [nfdump-devel]Unknown
Source package: [nfdump]
Details (1)
1.7.8-1.3· x86_64 · tumbleweedUnknown · Fixed:
1.6.23-1.3Version impact unknown
dsa · nfdump · opensuse · tumbleweed
- [icecream]Fixed
Source package: [icecream]
Details (1)
1.4.0-4.5· x86_64 · tumbleweedFixed · Fixed:
1.3.1-3.7dsa · icecream · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [busybox]Fixed
Source package: [busybox]
Details (2)
1:1.35.0-4+deb12u1+b1· amd64 · bookwormFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
1:1.35.0-4+deb12u1+b1· arm64 · bookwormFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- [busybox-static]Fixed
Source package: [busybox]
Details (2)
1:1.35.0-4+deb12u1+b1· amd64 · bookwormFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
1:1.35.0-4+deb12u1+b1· arm64 · bookwormFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- [busybox-syslogd]Fixed
Source package: [busybox]
Details (2)
1:1.35.0-4+deb12u1· all · bookwormFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
1:1.35.0-4+deb12u1· all · bookwormFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- [liblzo2-2]Fixed
Source package: [lzo2]
Details (2)
2.10-2· amd64 · bookwormFixed · Fixed:
2.08-1dsa · lzo2 · debian · bookworm; dsa · lzo2 · debian · 12
2.10-2· arm64 · bookwormFixed · Fixed:
2.08-1dsa · lzo2 · debian · bookworm; dsa · lzo2 · debian · 12
- [liblzo2-dev]Fixed
Source package: [lzo2]
Details (2)
2.10-2· amd64 · bookwormFixed · Fixed:
2.08-1dsa · lzo2 · debian · bookworm; dsa · lzo2 · debian · 12
2.10-2· arm64 · bookwormFixed · Fixed:
2.08-1dsa · lzo2 · debian · bookworm; dsa · lzo2 · debian · 12
- [udhcpc]Fixed
Source package: [busybox]
Details (2)
1:1.35.0-4+deb12u1+b1· amd64 · bookwormFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
1:1.35.0-4+deb12u1+b1· arm64 · bookwormFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
- [udhcpd]Fixed
Source package: [busybox]
Details (2)
1:1.35.0-4+deb12u1+b1· amd64 · bookwormFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
1:1.35.0-4+deb12u1+b1· arm64 · bookwormFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · bookworm; dsa · busybox · debian · 12
[Debian 13 (Trixie)]
- [busybox]Fixed
Source package: [busybox]
Details (2)
1:1.37.0-6+b8· amd64 · trixieFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · 13
1:1.37.0-6+b8· arm64 · trixieFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · 13
- [busybox-static]Fixed
Source package: [busybox]
Details (2)
1:1.37.0-6+b8· amd64 · trixieFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · 13
1:1.37.0-6+b8· arm64 · trixieFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · 13
- [busybox-syslogd]Fixed
Source package: [busybox]
Details (2)
1:1.37.0-6· all · trixieFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · 13
1:1.37.0-6· all · trixieFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · 13
- [liblzo2-2]Fixed
Source package: [lzo2]
Details (2)
2.10-3+b1· amd64 · trixieFixed · Fixed:
2.08-1dsa · lzo2 · debian · 13
2.10-3+b1· arm64 · trixieFixed · Fixed:
2.08-1dsa · lzo2 · debian · 13
- [liblzo2-dev]Fixed
Source package: [lzo2]
Details (2)
2.10-3+b1· amd64 · trixieFixed · Fixed:
2.08-1dsa · lzo2 · debian · 13
2.10-3+b1· arm64 · trixieFixed · Fixed:
2.08-1dsa · lzo2 · debian · 13
- [udhcpc]Fixed
Source package: [busybox]
Details (2)
1:1.37.0-6· all · trixieFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · 13
1:1.37.0-6· all · trixieFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · 13
- [udhcpd]Fixed
Source package: [busybox]
Details (2)
1:1.37.0-6· all · trixieFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · 13
1:1.37.0-6· all · trixieFixed · Fixed:
1:1.22.0-10dsa · busybox · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10342-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2014-4607]
- [https://osv.dev/vulnerability/DLA-35-1]
- [https://osv.dev/vulnerability/DSA-2995-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2014-4607]
- [https://osv.dev/vulnerability/USN-2300-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:10854-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:11089-1]
- [https://security-tracker.debian.org/tracker/CVE-2014-4607]
- [https://security.access.redhat.com/data/csaf/v2/vex/2014/cve-2014-4607.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]