Every CVE Search/ Get API key

CVE-2014-9474

Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context...

9.8 CriticalFix available

Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context-dependent attackers to have unspecified impact via vectors related to incorrect documentation for mpn_set_str.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.55%Up 3.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context-dependent attackers to have unspecified impact via vectors related to incorrect documentation for mpn_set_str.

Record
CVE-2014-9474
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context-dependent attackers to have unspecified impact via vectors related to incorrect documentation for mpn_set_str.

Record
CVE-2014-9474
Updated
2026-11-02
EUVDEUVD-2014-9293 No score

Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context-dependent attackers to have unspecified impact via vectors related to incorrect documentation for mpn_set_str.

Record
EUVD-2014-9293
Updated
2026-11-03
GitHub AdvisoriesGHSA-8r23-r9vm-pp93 9.8

Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context...

Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context-dependent attackers to have unspecified impact via vectors related to incorrect documentation for mpn_set_str.

Record
GHSA-8r23-r9vm-pp93
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-119
Updated
2026-11-02
OSV 9.8

Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context-dependent attackers to have unspecified impact via vectors related to incorrect documentation for mpn_set_str.

Record
CVE-2014-9474
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2014-9474 9.8

Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context-dependent attackers to have unspecified impact via vectors related to incorrect documentation for mpn_set_str.

Record
DEBIAN-CVE-2014-9474
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVRHSA-2025:9332 7.0

Red Hat Security Advisory: mpfr security update

Record
RHSA-2025:9332
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2014-9474 9.8

Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context-dependent attackers to have unspecified impact via vectors related to incorrect documentation for mpn_set_str.

Record
UBUNTU-CVE-2014-9474
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2025-1757409276 No score

mpfr: Fix of CVE-2014-9474

  • CVE-2014-9474: Fix of a buffer overflow due to incorrect GMP documentation for mpn_set_str
Record
CLSA-2025-1757409276
Updated
2026-11-02
OSVCLSA-2025-1757427840 No score

mpfr: Fix of CVE-2014-9474

  • CVE-2014-9474: Fix of a buffer overflow due to incorrect GMP documentation for mpn_set_str
Record
CLSA-2025-1757427840
Updated
2026-11-02
OSVMGASA-2015-0021 No score

Updated mpfr packages fix CVE-2014-9474

Updated mpfr packages fix security vulnerability:

A buffer overflow was reported in mpfr. This is due to incorrect GMP documentation for mpn_set_str about the size of a buffer (CVE-2014-9474).

Record
MGASA-2015-0021
Updated
2026-11-02
OSVopenSUSE-SU-2024:10472-1 No score

libmpfr4-3.1.5-2.1 on GA media

These are all security issues fixed in the libmpfr4-3.1.5-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10472-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mpfr
TuxCare:RHEL:7
 before 3.1.1-4.el7.tuxcare.els1
3.1.1-4.el7.tuxcare.els1
mpfr-devel
TuxCare:RHEL:7
 before 3.1.1-4.el7.tuxcare.els1
3.1.1-4.el7.tuxcare.els1
mpfr
TuxCare:CentOS:7
 before 3.1.1-4.el7.tuxcare.els1
3.1.1-4.el7.tuxcare.els1
mpfr-devel
TuxCare:CentOS:7
 before 3.1.1-4.el7.tuxcare.els1
3.1.1-4.el7.tuxcare.els1
mpfr4
Debian:12
 before 3.1.2-2
3.1.2-2
mpfr4
Debian:13
 before 3.1.2-2
3.1.2-2
mpfr4
Debian:14
 before 3.1.2-2
3.1.2-2
mpfr
Mageia:4
 before 3.1.2-2.1.mga4
3.1.2-2.1.mga4
mpfr
Red Hat:rhel_els:7
 before 0:3.1.1-4.el7_9.2
0:3.1.1-4.el7_9.2
mpfr-debuginfo
Red Hat:rhel_els:7
 before 0:3.1.1-4.el7_9.2
0:3.1.1-4.el7_9.2
mpfr-devel
Red Hat:rhel_els:7
 before 0:3.1.1-4.el7_9.2
0:3.1.1-4.el7_9.2
mpfr4
Ubuntu:14.04:LTS
 All versions, plus listed versions
3.1.1-23.1.2-1
 None known
mpfr
openSUSE:Tumbleweed
 before 3.1.5-2.1
3.1.5-2.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9474 is a critical vulnerability (CVSS 9.8) in Mpfr Gnu Mpfr, published January 9, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.55%, the 91st percentile. Fixed in mpfr 3.1.1-4.el7.tuxcare.els1.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open