{"id":"CVE-2014-1878","aliases":["DEBIAN-CVE-2014-1878","DLA-1615-1","DLA-461-1","DLA-60-1","DSA-2956-1","EUVD-2014-1940","GHSA-fv88-xv9q-4vg3","MGASA-2014-0186","UBUNTU-CVE-2014-1878","USN-3253-1","openSUSE-SU-2024:11073-1"],"status":"published","title":"Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0...","description":"Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03195,"percentile":0.88197,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2014-02-28T00:00:00Z","modified":"2026-06-17T00:05:41Z","fixes":[{"ecosystem":"Debian:7","package":"nagios3","fixed_in":["3.4.1-3+deb7u2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"nagios","fixed_in":["3.4.4-4.3.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"nagios","fixed_in":["4.0.2-1.1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"nagios3","fixed_in":["3.5.1-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"nagios3","fixed_in":["3.5.1.dfsg-2.1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:8","package":"nagios3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1.dfsg-2+deb8u1"}]}],"versions":["3.5.1.dfsg-2"],"bundled":5},{"source":"osv","ecosystem":"Debian:7","package":"nagios3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-3+deb7u2"}]}],"versions":["3.4.1-3","3.4.1-3+deb7u1"]},{"source":"osv","ecosystem":"Debian:6.0","package":"icinga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2+squeeze2"}]}],"versions":["1.0.2-2","1.0.2-2+squeeze1"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"icinga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-7"}]}],"versions":["1.7.1-6"],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"nagios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-4.3.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"nagios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-1.1.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nagios3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1ubuntu1.1"}]}],"versions":["3.4.1-5ubuntu2","3.4.1-5ubuntu3","3.5.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nagios3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1.dfsg-2.1ubuntu1.1"}]}],"versions":["3.5.1-1ubuntu4","3.5.1.dfsg-2ubuntu1","3.5.1.dfsg-2ubuntu2","3.5.1.dfsg-2.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nagios3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1ubuntu1.1"}]}],"versions":["3.4.1-5ubuntu2","3.4.1-5ubuntu3","3.5.1-1ubuntu1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nagios3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1.dfsg-2.1ubuntu1.1"}]}],"versions":["3.5.1-1ubuntu4","3.5.1.dfsg-2ubuntu1","3.5.1.dfsg-2ubuntu2","3.5.1.dfsg-2.1ubuntu1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nagios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-2.5"}]}],"bundled":17}],"products":[{"vendor":"icinga","product":"icinga"},{"vendor":"nagios","product":"nagios"}],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2014-04/msg00033.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://dev.icinga.org/issues/5434","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"https://www.icinga.org/2014/02/11/bugfix-releases-1-10-3-1-9-5-1-8-6","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066578","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/65605","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/12/msg00014.html","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://secunia.com/advisories/57024","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1878"},{"url":"https://github.com/advisories/GHSA-fv88-xv9q-4vg3"},{"url":"https://advisories.mageia.org/MGASA-2014-0186.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13197","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-1878","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3253-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-1878","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-7108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-7205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9566","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-2162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13977","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-1878","description":"Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.","status":"published","published":"2014-02-28T15:00:00Z","modified":"2024-08-06T09:58:16.149Z","updated_at":"2026-11-02T14:33:45.938615Z"}],"euvd":[{"id":"EUVD-2014-1940","description":"Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.","status":"published","published":"2014-02-28T15:00:00Z","modified":"2024-08-06T09:58:16Z","updated_at":"2026-11-03T01:57:16.268492Z"}],"ghsa":[{"id":"GHSA-fv88-xv9q-4vg3","title":"Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0...","description":"Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.","status":"published","published":"2022-05-14T01:45:49Z","modified":"2023-02-02T05:04:16Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:51:50.069193Z"}],"nvd":[{"id":"CVE-2014-1878","description":"Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.","status":"published","published":"2014-02-28T15:13:04.063Z","modified":"2026-06-17T00:05:41.13Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:53.330367Z"}],"osv":[{"id":"DLA-1615-1","title":"nagios3 - security update","status":"published","published":"2018-12-24T00:00:00Z","modified":"2026-03-09T01:18:24.058758Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-461-1","title":"nagios3 - security update","status":"published","published":"2016-05-07T00:00:00Z","modified":"2026-03-09T02:11:42.380267Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DLA-60-1","title":"icinga - security update","status":"published","published":"2014-09-24T00:00:00Z","modified":"2026-03-09T02:11:39.134608Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-2956-1","title":"icinga - security update","status":"published","published":"2014-06-11T00:00:00Z","modified":"2026-03-09T01:18:14.344727Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0186","title":"Updated nagios packages fix CVE-2014-1878","description":"Updated nagios packages fix security vulnerability:\n\nStack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in\nNagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9\nbefore 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a\ndenial of service (segmentation fault) via a long message to cmd.cgi\n(CVE-2014-1878).\n","status":"published","published":"2014-04-23T16:01:02Z","modified":"2026-04-16T06:24:53.606065373Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:11073-1","title":"nagios-4.4.6-2.5 on GA media","description":"These are all security issues fixed in the nagios-4.4.6-2.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:19.000922Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"UBUNTU-CVE-2014-1878","description":"Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.","status":"published","published":"2014-02-28T00:00:00Z","modified":"2026-02-04T02:58:33.618944Z","updated_at":"2026-11-02T15:54:07.855521Z"},{"id":"USN-3253-1","title":"nagios3 vulnerabilities","description":"It was discovered that Nagios incorrectly handled certain long strings. A\nremote authenticated attacker could use this issue to cause Nagios to\ncrash, resulting in a denial of service, or possibly obtain sensitive\ninformation. (CVE-2013-7108, CVE-2013-7205)\n\nIt was discovered that Nagios incorrectly handled certain long messages to\ncmd.cgi. A remote attacker could possibly use this issue to cause Nagios to\ncrash, resulting in a denial of service. (CVE-2014-1878)\n\nDawid Golunski discovered that Nagios incorrectly handled symlinks when\naccessing log files. A local attacker could possibly use this issue to\nelevate privileges. In the default installation of Ubuntu, this should be\nprevented by the Yama link restrictions. (CVE-2016-9566)\n","status":"published","published":"2017-04-03T17:42:28Z","modified":"2026-02-10T04:41:06Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}