CVE-2014-8119
The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of...
7.5 HighFix available
The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application crash) via vectors involving augeas path expressions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
2.65%Up 1.5 points since Feb 4, 2022
What each source reports
NVD Score used
The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application crash) via vectors involving augeas path expressions.
- Record
CVE-2014-8119- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application crash) via vectors involving augeas path expressions.
- Record
CVE-2014-8119- Updated
- 2026-11-02
EUVDEUVD-2014-7964 No score
The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application crash) via vectors involving augeas path expressions.
- Record
EUVD-2014-7964- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rqwf-j354-5q38
The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of...
The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application crash) via vectors involving augeas path expressions.
- Record
GHSA-rqwf-j354-5q38- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10641-1 No score
augeas-1.12.0-4.2 on GA media
These are all security issues fixed in the augeas-1.12.0-4.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10641-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1249-1 No score
Security update for augeas
This update fixes an untrusted argument escaping problem (CVE-2014-8119):
- new API - aug_escape_name() - which can be used to escape untrusted inputs before using them as part of path expressions
- aug_match() is changed to return properly escaped output
- Record
SUSE-SU-2015:1249-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1792-1 No score
Security update for augeas
This update fixes an untrusted argument escaping problem (CVE-2014-8119):
- new API - aug_escape_name() - which can be used to escape untrusted inputs before using them as part of path expressions
- aug_match() is changed to return properly escaped output
- Record
SUSE-SU-2015:1792-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0653-1 No score
Security update for augeas
This update for augeas fixes the following issues:
Security issues fixed:
- CVE-2017-7555: Fix a memory corruption bug could have lead to arbitrary code execution by passing crafted strings that would be mis-handled by parse_name() (bsc#1054171).
- CVE-2014-8119: Fix improper handling of escaped strings leading to memory corruption (bsc#925225).
- Record
SUSE-SU-2018:0653-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
netcfRed Hat:enterprise_linux:6::client |
before 0:0.2.4-3.el6 | 0:0.2.4-3.el6 |
netcf-debuginfoRed Hat:enterprise_linux:6::client |
before 0:0.2.4-3.el6 | 0:0.2.4-3.el6 |
netcf-develRed Hat:enterprise_linux:6::client |
before 0:0.2.4-3.el6 | 0:0.2.4-3.el6 |
netcf-libsRed Hat:enterprise_linux:6::client |
before 0:0.2.4-3.el6 | 0:0.2.4-3.el6 |
netcfRed Hat:enterprise_linux:6::computenode |
before 0:0.2.4-3.el6 | 0:0.2.4-3.el6 |
netcf-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:0.2.4-3.el6 | 0:0.2.4-3.el6 |
netcf-develRed Hat:enterprise_linux:6::computenode |
before 0:0.2.4-3.el6 | 0:0.2.4-3.el6 |
netcf-libsRed Hat:enterprise_linux:6::computenode |
before 0:0.2.4-3.el6 | 0:0.2.4-3.el6 |
netcfRed Hat:enterprise_linux:6::server |
before 0:0.2.4-3.el6 | 0:0.2.4-3.el6 |
netcf-debuginfoRed Hat:enterprise_linux:6::server |
before 0:0.2.4-3.el6 | 0:0.2.4-3.el6 |
Show 38 moreShow less
| Package | Affected | Fixed |
|---|---|---|
netcf-develRed Hat:enterprise_linux:6::server |
before 0:0.2.4-3.el6 | 0:0.2.4-3.el6 |
netcf-libsRed Hat:enterprise_linux:6::server |
before 0:0.2.4-3.el6 | 0:0.2.4-3.el6 |
netcfRed Hat:enterprise_linux:6::workstation |
before 0:0.2.4-3.el6 | 0:0.2.4-3.el6 |
netcf-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:0.2.4-3.el6 | 0:0.2.4-3.el6 |
netcf-develRed Hat:enterprise_linux:6::workstation |
before 0:0.2.4-3.el6 | 0:0.2.4-3.el6 |
netcf-libsRed Hat:enterprise_linux:6::workstation |
before 0:0.2.4-3.el6 | 0:0.2.4-3.el6 |
netcfRed Hat:enterprise_linux:7::client |
before 0:0.2.8-1.el7 | 0:0.2.8-1.el7 |
netcf-debuginfoRed Hat:enterprise_linux:7::client |
before 0:0.2.8-1.el7 | 0:0.2.8-1.el7 |
netcf-develRed Hat:enterprise_linux:7::client |
before 0:0.2.8-1.el7 | 0:0.2.8-1.el7 |
netcf-libsRed Hat:enterprise_linux:7::client |
before 0:0.2.8-1.el7 | 0:0.2.8-1.el7 |
netcfRed Hat:enterprise_linux:7::computenode |
before 0:0.2.8-1.el7 | 0:0.2.8-1.el7 |
netcf-debuginfoRed Hat:enterprise_linux:7::computenode |
before 0:0.2.8-1.el7 | 0:0.2.8-1.el7 |
netcf-develRed Hat:enterprise_linux:7::computenode |
before 0:0.2.8-1.el7 | 0:0.2.8-1.el7 |
netcf-libsRed Hat:enterprise_linux:7::computenode |
before 0:0.2.8-1.el7 | 0:0.2.8-1.el7 |
netcfRed Hat:enterprise_linux:7::server |
before 0:0.2.8-1.el7 | 0:0.2.8-1.el7 |
netcf-debuginfoRed Hat:enterprise_linux:7::server |
before 0:0.2.8-1.el7 | 0:0.2.8-1.el7 |
netcf-develRed Hat:enterprise_linux:7::server |
before 0:0.2.8-1.el7 | 0:0.2.8-1.el7 |
netcf-libsRed Hat:enterprise_linux:7::server |
before 0:0.2.8-1.el7 | 0:0.2.8-1.el7 |
netcfRed Hat:enterprise_linux:7::workstation |
before 0:0.2.8-1.el7 | 0:0.2.8-1.el7 |
netcf-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:0.2.8-1.el7 | 0:0.2.8-1.el7 |
netcf-develRed Hat:enterprise_linux:7::workstation |
before 0:0.2.8-1.el7 | 0:0.2.8-1.el7 |
netcf-libsRed Hat:enterprise_linux:7::workstation |
before 0:0.2.8-1.el7 | 0:0.2.8-1.el7 |
augeasSUSE:Linux Enterprise Desktop 12 |
before 1.2.0-3.1 | 1.2.0-3.1 |
augeasSUSE:Linux Enterprise Software Development Kit 12 |
before 1.2.0-3.1 | 1.2.0-3.1 |
augeasSUSE:Linux Enterprise Server 12 |
before 1.2.0-3.1 | 1.2.0-3.1 |
augeasSUSE:Linux Enterprise Server for SAP Applications 12 |
before 1.2.0-3.1 | 1.2.0-3.1 |
augeasSUSE:Linux Enterprise Software Development Kit 11 SP3 |
before 0.9.0-3.17.2 | 0.9.0-3.17.2 |
augeasSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 0.9.0-3.17.2 | 0.9.0-3.17.2 |
augeasSUSE:Linux Enterprise Desktop 11 SP3 |
before 0.9.0-3.17.2 | 0.9.0-3.17.2 |
augeasSUSE:Linux Enterprise Desktop 11 SP4 |
before 0.9.0-3.17.2 | 0.9.0-3.17.2 |
augeasSUSE:Linux Enterprise Server 11 SP3 |
before 0.9.0-3.17.2 | 0.9.0-3.17.2 |
augeasSUSE:Linux Enterprise Server 11 SP3-TERADATA |
before 0.9.0-3.17.2 | 0.9.0-3.17.2 |
augeasSUSE:Linux Enterprise Server for SAP Applications 11 SP3 |
before 0.9.0-3.17.2 | 0.9.0-3.17.2 |
augeasSUSE:Linux Enterprise Server 11 SP4 |
before 0.9.0-3.17.2 | 0.9.0-3.17.2 |
augeasSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 0.9.0-3.17.2 | 0.9.0-3.17.2 |
augeasSUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 2 CVEs |
before 0.9.0-3.21.3.1 | 0.9.0-3.21.3.1 |
augeasSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 2 CVEs |
before 0.9.0-3.21.3.1 | 0.9.0-3.21.3.1 |
augeasSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 2 CVEs |
before 0.9.0-3.21.3.1 | 0.9.0-3.21.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-8119 is a high vulnerability (CVSS 7.5) in Netcf Project Netcf, published June 24, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.65%, the 85th percentile. Fixed in netcf 0:0.2.4-3.el6.
References
lists.fedoraproject.org/pipermail/package-announce/2015-May/157508.html
bugzilla.redhat.com/show_bug.cgi?id=1172176
pagure.io/netcf/blob/050b05c880a6b343baf86780d94764b1aafece37/f/NEWS
rhn.redhat.com/errata/RHSA-2015-2248.html
Show 27 moreShow less
securityfocus.com/bid/78046
nvd.nist.gov/vuln/detail/CVE-2014-8119
github.com/advisories/GHSA-rqwf-j354-5q38
access.redhat.com/errata/RHBA-2015:1307
security.access.redhat.com/data/csaf/v2/advisories/2015/rhba-2015_1307.json
cve.org/CVERecord?id=CVE-2014-8119
suse.com/support/update/announcement/2015/suse-su-20151249-1
bugzilla.suse.com/925225