CVE-2014-9275
UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash...
UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file.
Exploit likelihood
What each source reports
NVD Score used
UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file.
- Record
CVE-2014-9275- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file.
- Record
CVE-2014-9275- Updated
- 2026-11-02
EUVDEUVD-2014-9100 No score
UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file.
- Record
EUVD-2014-9100- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-745j-qpxw-g265 No score
UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash...
UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file.
- Record
GHSA-745j-qpxw-g265- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file.
- Record
CVE-2014-9275- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9275 No score
UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file.
- Record
DEBIAN-CVE-2014-9275- Updated
- 2026-11-02
OSVMGASA-2014-0533 No score
Updated unrtf package fixes security vulnerabilities
Updated unrtf package fixes security vulnerabilities:
Michal Zalewski reported an out-of-bounds memory access vulnerability in unrtf. Processing a malformed RTF file could lead to a segfault while accessing a pointer that may be under the attacker's control. This would lead to a denial of service (application crash) or, potentially, the execution of arbitrary code (CVE-2014-9274).
Hanno Böck also reported a number of other crashes in unrtf (CVE-2014-9275).
- Record
MGASA-2014-0533- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
unrtfDebian:12 |
before 0.21.5-2 | 0.21.5-2 |
unrtfDebian:13 |
before 0.21.5-2 | 0.21.5-2 |
unrtfDebian:14 |
before 0.21.5-2 | 0.21.5-2 |
unrtfDebian:6.0 |
before 0.19.3-1.1+deb6u1, plus listed versions 0.19.3-1.1 |
0.19.3-1.1+deb6u1 |
unrtfDebian:7 |
before 0.21.5-3~deb7u1, plus listed versions 0.19.3-1.10.21.2-10.21.2-20.21.3-10.21.3-20.21.5-10.21.5-2 |
0.21.5-3~deb7u1 |
unrtfMageia:4 |
before 0.21.7-1.mga4 | 0.21.7-1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9275 is a high vulnerability (CVSS 7.5) in Unrtf Project Unrtf, published December 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.74%, the 91st percentile. Fixed in unrtf 0.21.5-2.
References
advisories.mageia.org/MGASA-2014-0533.html
secunia.com/advisories/62811
lists.fedoraproject.org/pipermail/package-announce/2015-January/147399.html
openwall.com/lists/oss-security/2014/12/04/15
debian.org/security/2015/dsa-3158
Show 8 moreShow less
mandriva.com/security/advisories?name=MDVSA-2015:007
securityfocus.com/bid/71506
security.gentoo.org/glsa/201507-06
bugzilla.redhat.com/show_bug.cgi?id=1170233
nvd.nist.gov/vuln/detail/CVE-2014-9275
github.com/advisories/GHSA-745j-qpxw-g265
security-tracker.debian.org/tracker/CVE-2014-9275
bugs.mageia.org/show_bug.cgi?id=14783