Every CVESearch/Get API key

CVE-2014-1878

Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0...

5.0 MediumFix available

CVE-2014-1878 is a medium vulnerability (CVSS 5.0) in Icinga, published February 28, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.19%, the 88th percentile. Fixed in nagios3 3.4.1-3+deb7u2.

What does this mean?
Severity
5.0 MediumCVSS 2.0, NVD
Exploit chance
3.19%EPSS, 88th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
3.4.1-3+deb7u2nagios3 +10 more

Description

Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.

Exploit likelihood

3.19%Up 1.9 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nagios3
Debian:8
From an advisory covering 5 CVEs
before 3.5.1.dfsg-2+deb8u1, plus listed versions
3.5.1.dfsg-2
3.5.1.dfsg-2+deb8u1
nagios3
Debian:7
before 3.4.1-3+deb7u2, plus listed versions
3.4.1-33.4.1-3+deb7u1
3.4.1-3+deb7u2
icinga
Debian:6.0
From an advisory covering 2 CVEs
before 1.0.2-2+squeeze2, plus listed versions
1.0.2-21.0.2-2+squeeze1
1.0.2-2+squeeze2
icinga
Debian:7
From an advisory covering 5 CVEs
before 1.7.1-7, plus listed versions
1.7.1-6
1.7.1-7
nagios
Mageia:3
before 3.4.4-4.3.mga3
3.4.4-4.3.mga3
nagios
Mageia:4
before 4.0.2-1.1.mga4
4.0.2-1.1.mga4
nagios3
Ubuntu:14.04:LTS
before 3.5.1-1ubuntu1.1, plus listed versions
3.4.1-5ubuntu23.4.1-5ubuntu33.5.1-1ubuntu1
3.5.1-1ubuntu1.1
nagios3
Ubuntu:16.04:LTS
before 3.5.1.dfsg-2.1ubuntu1.1, plus listed versions
3.5.1-1ubuntu43.5.1.dfsg-2ubuntu13.5.1.dfsg-2ubuntu23.5.1.dfsg-2.1ubuntu1
3.5.1.dfsg-2.1ubuntu1.1
nagios3
Ubuntu:14.04:LTS
From an advisory covering 4 CVEs
before 3.5.1-1ubuntu1.1, plus listed versions
3.4.1-5ubuntu23.4.1-5ubuntu33.5.1-1ubuntu1
3.5.1-1ubuntu1.1
nagios3
Ubuntu:16.04:LTS
From an advisory covering 4 CVEs
before 3.5.1.dfsg-2.1ubuntu1.1, plus listed versions
3.5.1-1ubuntu43.5.1.dfsg-2ubuntu13.5.1.dfsg-2ubuntu23.5.1.dfsg-2.1ubuntu1
3.5.1.dfsg-2.1ubuntu1.1
nagios
openSUSE:Tumbleweed
From an advisory covering 17 CVEs
before 4.4.6-2.5
4.4.6-2.5

What each source reports

NVD Score used5.0

Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.

Record
CVE-2014-1878
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE ListNo score

Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.

Record
CVE-2014-1878
Updated
2026-11-02
EUVDEUVD-2014-1940No score

Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.

Record
EUVD-2014-1940
Updated
2026-11-03
GitHub AdvisoriesGHSA-fv88-xv9q-4vg3No score

Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0...

Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.

Record
GHSA-fv88-xv9q-4vg3
Weakness
CWE-119
Updated
2026-11-02
OSVMGASA-2014-0186No score

Updated nagios packages fix CVE-2014-1878

Updated nagios packages fix security vulnerability:

Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi (CVE-2014-1878).

Record
MGASA-2014-0186
Updated
2026-11-02
OSVopenSUSE-SU-2024:11073-1No score

nagios-4.4.6-2.5 on GA media

These are all security issues fixed in the nagios-4.4.6-2.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11073-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-1878No score

Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.

Record
UBUNTU-CVE-2014-1878
Updated
2026-11-02
OSVUSN-3253-1No score

nagios3 vulnerabilities

It was discovered that Nagios incorrectly handled certain long strings. A remote authenticated attacker could use this issue to cause Nagios to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2013-7108, CVE-2013-7205)

It was discovered that Nagios incorrectly handled certain long messages to cmd.cgi. A remote attacker could possibly use this issue to cause Nagios to crash, resulting in a denial of service. (CVE-2014-1878)

Dawid Golunski discovered that Nagios incorrectly handled symlinks when accessing log files. A local attacker could possibly use this issue to elevate privileges. In the default installation of Ubuntu, this should be prevented by the Yama link restrictions. (CVE-2016-9566)

Record
USN-3253-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 28 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open