Every CVE Search/ Get API key

CVE-2014-9862

Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6...

7.8 HighFix available

Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

6.76%Up 2.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.8

Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.

Record
CVE-2014-9862
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-190
Updated
2026-11-02
CVE List No score

Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.

Record
CVE-2014-9862
Updated
2026-11-02
EUVDEUVD-2014-9667 No score

Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.

Record
EUVD-2014-9667
Updated
2026-11-03
GitHub AdvisoriesGHSA-gv4w-9q78-3649 7.8

Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6...

Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.

Record
GHSA-gv4w-9q78-3649
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
OSV 7.8

Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.

Record
CVE-2014-9862
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2014-9862 7.8

Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.

Record
DEBIAN-CVE-2014-9862
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 10 moreShow less
OSVUBUNTU-CVE-2014-9862 7.8

Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.

Record
UBUNTU-CVE-2014-9862
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2016-0288 No score

Updated bsdiff packages fix security vulnerability

Integer signedness error in bspatch.c in bspatch in bsdiff allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file (CVE-2014-9862).

Record
MGASA-2016-0288
Updated
2026-11-02
OSVMGASA-2022-0334 No score

Updated ostree packages fix security vulnerability

A memory corruption issue that could be triggered when diffing binary files. (CVE-2014-9862)

Record
MGASA-2022-0334
Updated
2026-11-02
OSVopenSUSE-SU-2024:10045-1 No score

bsdiff-4.3-5.3 on GA media

These are all security issues fixed in the bsdiff-4.3-5.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10045-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12242-1 No score

libostree-1-1-2022.5-1.1 on GA media

These are all security issues fixed in the libostree-1-1-2022.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12242-1
Updated
2026-11-02
OSVSUSE-SU-2022:3094-1 No score

Security update for libostree

This update for libostree fixes the following issues:

  • CVE-2014-9862: Fixed a memory corruption issue that could be triggered when diffing binary files (bsc#1201770).
Record
SUSE-SU-2022:3094-1
Updated
2026-11-02
OSVSUSE-SU-2022:3455-1 No score

Security update for libostree

This update for libostree fixes the following issues:

  • CVE-2014-9862: Fixed arbitrary write on heap vulnerability (bsc#1201770).
Record
SUSE-SU-2022:3455-1
Updated
2026-11-02
OSVSUSE-SU-2022:3456-1 No score

Security update for libostree

This update for libostree fixes the following issues:

  • CVE-2014-9862: Fixed arbitrary write on heap vulnerability (bsc#1201770).
Record
SUSE-SU-2022:3456-1
Updated
2026-11-02
OSVSUSE-SU-2022:3671-1 No score

Security update for libostree

This update for libostree fixes the following issues:

  • CVE-2014-9862: Fixed arbitrary write on heap vulnerability (bsc#1201770).
Record
SUSE-SU-2022:3671-1
Updated
2026-11-02
OSVUSN-4500-1 No score

bsdiff vulnerabilities

It was discovered that bsdiff mishandled certain input. If a user were tricked into opening a malicious file, an attacker could cause bsdiff to crash or potentially execute arbitrary code.

Record
USN-4500-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bsdiff
Debian:12
 before 4.3-17
4.3-17
bsdiff
Debian:13
 before 4.3-17
4.3-17
bsdiff
Debian:14
 before 4.3-17
4.3-17
bsdiff
Debian:8
 before 4.3-15+deb8u1, plus listed versions
4.3-15
4.3-15+deb8u1
bsdiff
Debian:7
 before 4.3-14+deb7u1, plus listed versions
4.3-14
4.3-14+deb7u1
bsdiff
Mageia:5
 before 4.3-9.1.mga5
4.3-9.1.mga5
ostree
Mageia:8
 before 2020.8-2.1.mga8
2020.8-2.1.mga8
libostree
SUSE:Linux Enterprise Module for Basesystem 15 SP4
 before 2021.6-150400.3.3.1
2021.6-150400.3.3.1
libostree
SUSE:Linux Enterprise Module for Desktop Applications 15 SP4
 before 2021.6-150400.3.3.1
2021.6-150400.3.3.1
libostree
openSUSE:Leap 15.4
 before 2021.6-150400.3.3.1
2021.6-150400.3.3.1
Show 24 moreShow less
Affected packages
PackageAffectedFixed
libostree
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 2018.9-150100.7.4.1
2018.9-150100.7.4.1
libostree
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 2018.9-150100.7.4.1
2018.9-150100.7.4.1
libostree
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 2018.9-150100.7.4.1
2018.9-150100.7.4.1
libostree
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 2018.9-150100.7.4.1
2018.9-150100.7.4.1
libostree
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 2018.9-150100.7.4.1
2018.9-150100.7.4.1
libostree
SUSE:Enterprise Storage 6
 before 2018.9-150100.7.4.1
2018.9-150100.7.4.1
libostree
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 2020.8-150200.3.6.1
2020.8-150200.3.6.1
libostree
SUSE:Linux Enterprise Module for Desktop Applications 15 SP3
 before 2020.8-150200.3.6.1
2020.8-150200.3.6.1
libostree
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
 before 2020.8-150200.3.6.1
2020.8-150200.3.6.1
libostree
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 2020.8-150200.3.6.1
2020.8-150200.3.6.1
libostree
SUSE:Linux Enterprise Server 15 SP2-BCL
 before 2020.8-150200.3.6.1
2020.8-150200.3.6.1
libostree
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 2020.8-150200.3.6.1
2020.8-150200.3.6.1
libostree
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 2020.8-150200.3.6.1
2020.8-150200.3.6.1
libostree
SUSE:Manager Proxy 4.1
 before 2020.8-150200.3.6.1
2020.8-150200.3.6.1
libostree
SUSE:Manager Retail Branch Server 4.1
 before 2020.8-150200.3.6.1
2020.8-150200.3.6.1
libostree
SUSE:Manager Server 4.1
 before 2020.8-150200.3.6.1
2020.8-150200.3.6.1
libostree
SUSE:Enterprise Storage 7
 before 2020.8-150200.3.6.1
2020.8-150200.3.6.1
libostree
openSUSE:Leap 15.3
 before 2020.8-150200.3.6.1
2020.8-150200.3.6.1
libostree
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 2018.1-150000.4.3.1
2018.1-150000.4.3.1
libostree
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 2018.1-150000.4.3.1
2018.1-150000.4.3.1
libostree
SUSE:Linux Enterprise Server 15-LTSS
 before 2018.1-150000.4.3.1
2018.1-150000.4.3.1
libostree
SUSE:Linux Enterprise Server for SAP Applications 15
 before 2018.1-150000.4.3.1
2018.1-150000.4.3.1
bsdiff
Ubuntu:16.04:LTS
 before 4.3-15+deb8u1build0.16.04.1, plus listed versions
4.3-15
4.3-15+deb8u1build0.16.04.1
bsdiff
openSUSE:Tumbleweed
 before 4.3-5.3
4.3-5.3

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9862 is a high vulnerability (CVSS 7.8) in Apple Mac Os X, published July 22, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.76%, the 93rd percentile. Fixed in bsdiff 4.3-17.

References

Show 26 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open