{"id":"CVE-2014-4040","aliases":["DEBIAN-CVE-2014-4040","EUVD-2014-3971","GHSA-c7rv-hg7f-px75","RHSA-2015:0384","SUSE-RU-2015:0574-1","SUSE-SU-2015:0232-1","SUSE-SU-2025:21067-1","UBUNTU-CVE-2014-4040"],"status":"published","title":"snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially...","description":"snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01826,"percentile":0.7894,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310"],"published":"2014-06-17T15:00:00Z","modified":"2026-10-23T15:47:39Z","fixes":[{"ecosystem":"Debian:12","package":"powerpc-utils","fixed_in":["1.3.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"powerpc-utils","fixed_in":["1.3.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"powerpc-utils","fixed_in":["1.3.1-2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"powerpc-utils","fixed_in":["0:1.2.24-7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"powerpc-utils-debuginfo","fixed_in":["0:1.2.24-7.el7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12","package":"powerpc-utils","fixed_in":["1.2.22-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"powerpc-utils","fixed_in":["1.2.22-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"powerpc-utils","fixed_in":["1.3.12-slfo.1.1_5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"powerpc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"powerpc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"powerpc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"powerpc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.24-7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"powerpc-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.24-7.el7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"powerpc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.22-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"powerpc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.22-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"powerpc-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.12-slfo.1.1_5.1"}]}]}],"products":[{"vendor":"powerpc-utils_project","product":"powerpc-utils"}],"references":[{"url":"http://openwall.com/lists/oss-security/2014/06/17/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0384.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-4040","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c7rv-hg7f-px75"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-4040","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0384","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1110520","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0384.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-4040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-4040","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-20150574-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/879310","tags":["report"]},{"url":"https://bugzilla.suse.com/879839","tags":["report"]},{"url":"https://bugzilla.suse.com/883174","tags":["report"]},{"url":"https://bugzilla.suse.com/901216","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4040","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150232-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521067-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200731","tags":["report"]},{"url":"https://bugzilla.suse.com/1238322","tags":["report"]},{"url":"https://bugzilla.suse.com/1246126","tags":["report"]},{"url":"https://bugzilla.suse.com/1249152","tags":["report"]},{"url":"https://bugzilla.suse.com/430790","tags":["report"]},{"url":"https://bugzilla.suse.com/866675","tags":["report"]},{"url":"https://bugzilla.suse.com/869852","tags":["report"]},{"url":"https://bugzilla.suse.com/886123","tags":["report"]},{"url":"https://bugzilla.suse.com/887275","tags":["report"]},{"url":"https://bugzilla.suse.com/933651","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-4040","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-4040","description":"snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.","status":"published","published":"2014-06-17T15:00:00Z","modified":"2024-08-06T11:04:27.889Z","updated_at":"2026-11-02T14:33:45.263043Z"}],"euvd":[{"id":"EUVD-2014-3971","description":"snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.","status":"published","published":"2014-06-17T15:00:00Z","modified":"2024-08-06T11:04:27Z","updated_at":"2026-11-03T01:57:08.409137Z"}],"ghsa":[{"id":"GHSA-c7rv-hg7f-px75","title":"snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially...","description":"snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.","status":"published","published":"2022-05-17T04:14:57Z","modified":"2023-01-28T05:01:31Z","updated_at":"2026-11-02T14:43:34.628173Z"}],"nvd":[{"id":"CVE-2014-4040","description":"snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.","status":"published","published":"2014-06-17T15:55:06.317Z","modified":"2026-06-17T00:09:20.227Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:54.464139Z"}],"osv":[{"id":"CVE-2014-4040","description":"snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.","status":"published","published":"2014-06-17T15:55:06Z","modified":"2026-04-10T03:44:41.301508Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-4040","description":"snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.","status":"published","published":"2014-06-17T15:55:06.317Z","modified":"2026-10-23T15:47:39.989261754Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"RHSA-2015:0384","title":"Red Hat Security Advisory: powerpc-utils security, bug fix, and enhancement update","status":"published","published":"2024-09-15T21:57:08Z","modified":"2025-11-22T10:58:52Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-RU-2015:0574-1","title":"Security update for powerpc-utils","description":"\nThe 'snap' system information collection tool of the PowerPC Utils package \ncollected fstab and yaboot.conf files which might contain passwords. \n(CVE-2014-4040)\n\nAs these files are of interest, we now print a warning that the user of the \n'snap' tool should check if private passwords are in those files.\n\nSecurity Issues:\n\n    * CVE-2014-4040\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4040\u003e\n\n","status":"published","published":"2014-09-12T14:57:27Z","modified":"2025-05-02T04:04:07.082707Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0232-1","title":"Security update for powerpc-utils","description":"powerpc-utils was updated to fix one security issue.\n\nThis security issue was fixed:\n- May expose passwords from fstab or yaboot.con (CVE-2014-4040).\n\nThis additional fix was included:\n- LPAR crashes when drmgr attempts to offline last remaining cpu core (bnc#901216)\n","status":"published","published":"2015-01-07T17:50:01Z","modified":"2026-02-04T02:54:36.25422Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2025:21067-1","title":"Security update for powerpc-utils","description":"This update for powerpc-utils fixes the following issues:\n\n- Start SMT service after networking (bsc#1249152 ltc#214730)\n- Fix inconsistent Core Online/Offline States Observed in lscpu and\n  ppc64_cpu --info Command Outputs During DLPAR Operation (bsc#1246126 ltc#214064)\n- Fix HNV installation network conflicts across all distributions (jsc#PED-3946)\n- Fix negative values of idle PURR (bsc#1238322 ltc#210808)\n\n","status":"published","published":"2025-11-10T14:24:22Z","modified":"2026-03-23T04:49:14.537625Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"UBUNTU-CVE-2014-4040","description":"snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.","status":"withdrawn","published":"2014-06-17T15:55:00Z","modified":"2025-07-16T07:02:09.589792Z","updated_at":"2026-11-02T15:54:09.010095Z"}]}}