CVE-2014-2892

Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows...

7.5 HighFix available

Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response.

Exploit likelihood

6.26%Down 5.0 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response.

Record: CVE-2014-2892
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response.

Record: CVE-2014-2892
Updated: 2026-11-02

EUVDEUVD-2014-2915 No score

Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response.

Record: EUVD-2014-2915
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3rq2-3cgx-j4rh No score

Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows...

Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response.

Record: GHSA-3rq2-3cgx-j4rh
Weakness: CWE-119
Updated: 2026-11-02

OSV No score

Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response.

Record: CVE-2014-2892
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-2892 No score

Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response.

Record: DEBIAN-CVE-2014-2892
Updated: 2026-11-05

OSVMGASA-2014-0190 No score

Updated libmms packages fix CVE-2014-2892

Updated libmms packages fix security vulnerability:

The libmms library before 0.6.4 is vulnerable to a buffer overflow in get_answer() in src/mmsh.c. It may be triggered via an overly long line of a MMSH (MMS over HTTP) server response, effectively overflowing the buffer which has a static size (CVE-2014-2892).

Record: MGASA-2014-0190
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10109-1 No score

libmms-devel-0.6.4-4.5 on GA media

These are all security issues fixed in the libmms-devel-0.6.4-4.5 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10109-1
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-2892 No score

Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response.

Record: UBUNTU-CVE-2014-2892
Updated: 2026-11-02

Affected products

libmms project libmms

Affected packages

Affected packages
Package	Affected	Fixed
`libmms` Debian:12	before 0.6.2-4	0.6.2-4
`libmms` Debian:13	before 0.6.2-4	0.6.2-4
`libmms` Debian:6.0	before 0.6-1+squeeze2, plus listed versions 0.6-10.6-1+squeeze1	0.6-1+squeeze2
`libmms` Debian:7	before 0.6.2-3+deb7u1, plus listed versions 0.6.2-3	0.6.2-3+deb7u1
`libmms` Mageia:3	before 0.6.2-3.1.mga3	0.6.2-3.1.mga3
`libmms` Mageia:4	before 0.6.2-4.1.mga4	0.6.2-4.1.mga4
`libmms` Ubuntu:14.04:LTS	before 0.6.2-3ubuntu2.1, plus listed versions 0.6.2-3ubuntu10.6.2-3ubuntu2	0.6.2-3ubuntu2.1
`libmss` openSUSE:Tumbleweed	before 0.6.4-4.5	0.6.4-4.5

History

History
Recorded	Changed	Sources
Nov 5, 2026	affected, facts	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-2892 is a high vulnerability (CVSS 7.5) in Libmms Project Libmms, published April 22, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.26%, the 93rd percentile. Fixed in libmms 0.6.2-4.

References

Show 11 moreShow less