CVE-2014-8567
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service ...
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
Exploit likelihood
What each source reports
NVD Score used
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
- Record
CVE-2014-8567- CVSS 2.0
- 9.4 High
AV:N/AC:L/Au:N/C:N/I:C/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
- Record
CVE-2014-8567- Updated
- 2026-11-02
EUVDEUVD-2014-8404 No score
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
- Record
EUVD-2014-8404- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wggx-3j62-wmwr No score
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service ...
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
- Record
GHSA-wggx-3j62-wmwr- Updated
- 2026-11-02
OSV No score
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
- Record
CVE-2014-8567- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-8567 No score
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
- Record
DEBIAN-CVE-2014-8567- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libapache2-mod-auth-mellonDebian:12 |
before 0.9.0 | 0.9.0 |
libapache2-mod-auth-mellonDebian:13 |
before 0.9.0 | 0.9.0 |
libapache2-mod-auth-mellonDebian:14 |
before 0.9.0 | 0.9.0 |
mod_auth_mellonRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:0.8.0-3.el6_6 | 0:0.8.0-3.el6_6 |
mod_auth_mellon-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:0.8.0-3.el6_6 | 0:0.8.0-3.el6_6 |
mod_auth_mellonRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:0.8.0-3.el6_6 | 0:0.8.0-3.el6_6 |
mod_auth_mellon-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:0.8.0-3.el6_6 | 0:0.8.0-3.el6_6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-8567 is a high vulnerability (CVSS 9.4) in Redhat Enterprise Linux Desktop, published November 14, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.59%, the 89th percentile. Fixed in libapache2-mod-auth-mellon 0.9.0.
References
linux.oracle.com/errata/ELSA-2014-1803.html
rhn.redhat.com/errata/RHSA-2014-1803.html
secunia.com/advisories/62094
postlister.uninett.no/sympa/arc/modmellon/2014-11/msg00000.html
github.com/UNINETT/mod_auth_mellon/commit/0f5b4fd860fa7e3a6c47201637aab05395f32647
Show 13 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-8567
security-tracker.debian.org/tracker/CVE-2014-8567
access.redhat.com/errata/RHSA-2014:1803
bugzilla.redhat.com/show_bug.cgi?id=1157281
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1803.json
cve.org/CVERecord?id=CVE-2014-8566