CVE-2014-0159
Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7...
Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument.
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument.
- Record
CVE-2014-0159- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument.
- Record
CVE-2014-0159- Updated
- 2026-11-02
EUVDEUVD-2014-0216 No score
Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument.
- Record
EUVD-2014-0216- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3gc4-fv8j-6mrr No score
Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7...
Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument.
- Record
GHSA-3gc4-fv8j-6mrr- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument.
- Record
CVE-2014-0159- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-0159 No score
Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument.
- Record
DEBIAN-CVE-2014-0159- Updated
- 2026-11-02
OSVMGASA-2014-0515 No score
Updated openafs packages fix security vulnerabilies
Updated openafs packages fix security vulnerabilities:
Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument (CVE-2014-0159).
OpenAFS before 1.6.7 delays the listen thread when an RXS_CheckResponse fails, which allows remote attackers to cause a denial of service (performance degradation) via an invalid packet (CVE-2014-2852).
OpenAFS 1.6.8 does not properly clear the fields in the host structure, which allows remote attackers to cause a denial of service (uninitialized memory access and crash) via unspecified vectors related to TMAY requests (CVE-2014-4044).
The OpenAFS package has been updated to version 1.6.10, fixing these issues and other bugs, as well as providing support for newer kernel versions.
- Record
MGASA-2014-0515- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0159 No score
Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument.
- Record
UBUNTU-CVE-2014-0159- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openafsDebian:12 |
before 1.6.7-1 | 1.6.7-1 |
openafsDebian:13 |
before 1.6.7-1 | 1.6.7-1 |
openafsDebian:6.0 |
before 1.4.12.1+dfsg-4+squeeze3, plus listed versions 1.4.12.1+dfsg-31.4.12.1+dfsg-41.4.12.1+dfsg-4+squeeze11.4.12.1+dfsg-4+squeeze21.4.12.1+dfsg-4~bpo50+1 |
1.4.12.1+dfsg-4+squeeze3 |
openafsDebian:7 |
before 1.6.1-3+deb7u2, plus listed versions 1.6.1-31.6.1-3+deb7u11.6.1-3+deb7u1~bpo60+11.6.1-3+deb7u2~bpo60+1 |
1.6.1-3+deb7u2 |
openafsMageia:4 |
before 1.6.10-1.1.mga4 | 1.6.10-1.1.mga4 |
openafsUbuntu:14.04:LTS |
before 1.6.7-1, plus listed versions 1.6.5-1ubuntu31.6.5.1-11.6.5.1-1ubuntu11.6.6~pre2-11.6.6-1 |
1.6.7-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-0159 is a medium vulnerability (CVSS 5.0) in Openafs, published April 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.16%, the 82nd percentile. Fixed in openafs 1.6.7-1.
References
openafs.org/pages/security/OPENAFS-SA-2014-001.txt
openafs.org/frameset/dl/openafs/1.6.7/ChangeLog
secunia.com/advisories/57779
mandriva.com/security/advisories?name=MDVSA-2014:244
debian.org/security/2014/dsa-2899
Show 19 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-0159
github.com/advisories/GHSA-3gc4-fv8j-6mrr
security-tracker.debian.org/tracker/CVE-2014-0159
advisories.mageia.org/MGASA-2014-0515.html
bugs.mageia.org/show_bug.cgi?id=13188
lists.openafs.org/pipermail/openafs-announce/2014/000455.html
ubuntu.com/security/CVE-2014-0159
cve.org/CVERecord?id=CVE-2014-0159