SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2014-3158

Integer overflow in the getword function in options.c in pppd in Paul's PPP Package (ppp) before 2.4.7 allows attackers to "access privileged options" via a long word in an options file, which triggers a heap-based buffer overflow that "[corrupts]…

HIGH 7.5EPSS 3.50%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (3.50%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Integer overflow in the getword function in options.c in pppd in Paul's PPP Package (ppp) before 2.4.7 allows attackers to "access privileged options" via a long word in an options file, which triggers a heap-based buffer overflow that "[corrupts] security-relevant variables."

CVSS 2.0
7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS
3.50% probability · 89th percentile
CISA KEV
Not listed
Weakness
CWE-119
Affected
point-to-point protocol project/point-to-point protocol
Source
chrome-cve-admin@google.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.