CVE-2014-2386
Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to...
Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to cause a denial of service (crash) via unspecified vectors to the (1) display_nav_table, (2) print_export_link, (3) page_num_selector, or (4) page_limit_selector function in cgi/cgiutils.c or (5) status_page_num_selector function in cgi/status.c, which triggers a stack-based buffer overflow.
Exploit likelihood
What each source reports
NVD Score used
Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to cause a denial of service (crash) via unspecified vectors to the (1) display_nav_table, (2) print_export_link, (3) page_num_selector, or (4) page_limit_selector function in cgi/cgiutils.c or (5) status_page_num_selector function in cgi/status.c, which triggers a stack-based buffer overflow.
- Record
CVE-2014-2386- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to cause a denial of service (crash) via unspecified vectors to the (1) display_nav_table, (2) print_export_link, (3) page_num_selector, or (4) page_limit_selector function in cgi/cgiutils.c or (5) status_page_num_selector function in cgi/status.c, which triggers a stack-based buffer overflow.
- Record
CVE-2014-2386- Updated
- 2026-11-02
EUVDEUVD-2014-2422 No score
Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to cause a denial of service (crash) via unspecified vectors to the (1) display_nav_table, (2) print_export_link, (3) page_num_selector, or (4) page_limit_selector function in cgi/cgiutils.c or (5) status_page_num_selector function in cgi/status.c, which triggers a stack-based buffer overflow.
- Record
EUVD-2014-2422- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9prg-2xvx-hr7x No score
Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to...
Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to cause a denial of service (crash) via unspecified vectors to the (1) display_nav_table, (2) print_export_link, (3) page_num_selector, or (4) page_limit_selector function in cgi/cgiutils.c or (5) status_page_num_selector function in cgi/status.c, which triggers a stack-based buffer overflow.
- Record
GHSA-9prg-2xvx-hr7x- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10182-1 No score
icinga-1.13.3-2.4 on GA media
These are all security issues fixed in the icinga-1.13.3-2.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10182-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
icingaDebian:7 |
before 1.7.1-7, plus listed versions 1.7.1-6 |
1.7.1-7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-2386 is a medium vulnerability (CVSS 5.0) in Icinga, published March 25, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.81%, the 86th percentile. Fixed in icinga 1.7.1-7.
References
comments.gmane.org/gmane.comp.security.oss.general/12355
lists.opensuse.org/opensuse-updates/2014-03/msg00072.html
dev.icinga.org/issues/5663
git.icinga.org?p=icinga-core.git%3Ba=commitdiff%3Bh=73285093b71a5551abdaab0a042d3d6bae093b0d
nvd.nist.gov/vuln/detail/CVE-2014-2386