Every CVESearch/Get API key

CVE-2014-0079

The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and...

5.0 Medium

CVE-2014-0079 is a medium vulnerability (CVSS 5.0) in Zarafa, published March 1, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. No source names a fixed version.

Severity
5.0 MediumCVSS 2.0, NVD
Exploit chance
1.84%EPSS, 79th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the password."

Exploit likelihood

1.84%Up 0.8 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
zarafa
Mageia:3
From an advisory covering 2 CVEs
before 7.1.8-1.1.mga3
7.1.8-1.1.mga3
zarafa
Mageia:4
From an advisory covering 2 CVEs
before 7.1.8-1.1.mga4
7.1.8-1.1.mga4

What each source reports

NVD Score used5.0

The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the password."

Record
CVE-2014-0079
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE ListNo score

The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the password."

Record
CVE-2014-0079
Updated
2026-11-02
EUVDEUVD-2014-0171No score

The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the password."

Record
EUVD-2014-0171
Updated
2026-11-03
GitHub AdvisoriesGHSA-w7w5-frm9-65qvNo score

The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and...

The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the password."

Record
GHSA-w7w5-frm9-65qv
Weakness
CWE-20
Updated
2026-11-02
OSVMGASA-2014-0112No score

Updated zarafa packages fix security vulnerabilities

Robert Scheck discovered multiple vulnerabilities in Zarafa that could allow a remote unauthenticated attacker to crash the zarafa-server daemon, preventing access to any other legitimate Zarafa users (CVE-2014-0037, CVE-2014-0079).

Record
MGASA-2014-0112
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open