{"id":"CVE-2014-2977","aliases":["EUVD-2014-2999","GHSA-r25x-m6r4-r5pf","MGASA-2015-0176","SUSE-SU-2015:0839-1","openSUSE-SU-2024:10535-1"],"status":"published","title":"Multiple integer signedness errors in the Dispatch_Write function in proxy/dispatcher...","description":"Multiple integer signedness errors in the Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB 1.4.13 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers a stack-based buffer overflow.","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.06776,"percentile":0.94031,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-189"],"published":"2014-06-11T14:00:00Z","modified":"2026-06-17T00:07:25Z","affected":[{"source":"osv","ecosystem":"Mageia:4","package":"directfb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-2.1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"DirectFB","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"DirectFB","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"DirectFB","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"DirectFB","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"DirectFB","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"DirectFB","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-5.9"}]}],"bundled":2}],"products":[{"vendor":"directfb","product":"directfb"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"suse","product":"linux_enterprise_desktop"},{"vendor":"suse","product":"linux_enterprise_software_development_kit"},{"vendor":"suse","product":"linux_enterprise_workstation_extension"},{"vendor":"suse","product":"suse_linux_enterprise_server"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2014/05/15/9","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:223","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00003.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201701-55","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00019.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://mail.directfb.org/pipermail/directfb-dev/2014-March/006805.html","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://advisories.mageia.org/MGASA-2015-0176.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://secunia.com/advisories/58448","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2977"},{"url":"https://github.com/advisories/GHSA-r25x-m6r4-r5pf"},{"url":"https://advisories.mageia.org/MGASA-2015-0176.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13391","tags":["report"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-04/msg00060.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150839-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/878345","tags":["report"]},{"url":"https://bugzilla.suse.com/878349","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2978","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2014-2977","description":"Multiple integer signedness errors in the Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB 1.4.13 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers a stack-based buffer overflow.","status":"published","published":"2014-06-11T14:00:00Z","modified":"2024-08-06T10:28:46.245Z","updated_at":"2026-11-02T14:33:43.883586Z"}],"euvd":[{"id":"EUVD-2014-2999","description":"Multiple integer signedness errors in the Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB 1.4.13 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers a stack-based buffer overflow.","status":"published","published":"2014-06-11T14:00:00Z","modified":"2024-08-06T10:28:46Z","updated_at":"2026-11-03T01:57:12.660671Z"}],"ghsa":[{"id":"GHSA-r25x-m6r4-r5pf","title":"Multiple integer signedness errors in the Dispatch_Write function in proxy/dispatcher...","description":"Multiple integer signedness errors in the Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB 1.4.13 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers a stack-based buffer overflow.","status":"published","published":"2022-05-14T02:04:17Z","modified":"2023-02-02T05:05:02Z","updated_at":"2026-11-02T14:52:01.039764Z"}],"nvd":[{"id":"CVE-2014-2977","description":"Multiple integer signedness errors in the Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB 1.4.13 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers a stack-based buffer overflow.","status":"published","published":"2014-06-11T14:55:07.47Z","modified":"2026-06-17T00:07:25.783Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:02:54.464139Z"}],"osv":[{"id":"MGASA-2015-0176","title":"Updated directfb packages fix security vulnerabilities","description":"Updated directfb packages fix security vulnerabilities:\n\nMultiple integer signedness errors in the Dispatch_Write function in\nproxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB allow remote\nattackers to cause a denial of service (crash) and possibly execute arbitrary\ncode via the Voodoo interface, which triggers a stack-based buffer overflow\n(CVE-2014-2977).\n\nThe Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c\nin DirectFB allows remote attackers to cause a denial of service (crash) and\npossibly execute arbitrary code via the Voodoo interface, which triggers an\nout-of-bounds write (CVE-2014-2978).\n","status":"published","published":"2015-05-03T00:19:16Z","modified":"2026-04-16T06:24:37.427701357Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10535-1","title":"DirectFB-1.7.7-5.9 on GA media","description":"These are all security issues fixed in the DirectFB-1.7.7-5.9 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:27:51.447273Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2015:0839-1","title":"Security update for DirectFB","description":"DirectFB was updated to fix two security issues.\n\nThe following vulnerabilities were fixed:\n\n* CVE-2014-2977: Multiple integer signedness errors could allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers a stack-based buffer overflow.\n* CVE-2014-2978: Remote attackers could cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers an out-of-bounds write.\n","status":"published","published":"2015-04-23T10:30:39Z","modified":"2026-02-04T02:46:37.120853Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}