CVE-2014-0004

Stack-based buffer overflow in udisks before 1.0.5 and 2.x before 2.1.3 allows local users to...

6.9 MediumFix available

CVE-2014-0004 is a medium vulnerability (CVSS 6.9) in Freedesktop Udisks, published March 10, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in udisks2 2.1.3-1.

What does this mean?

Severity: 6.9 MediumCVSS 2.0, NVD
Exploit chance: 0.43%EPSS, 37th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 2.1.3-1udisks2 +26 more

Description

Stack-based buffer overflow in udisks before 1.0.5 and 2.x before 2.1.3 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long mount point.

Exploit likelihood

0.43%Down 1.4 points since Feb 4, 2022

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`udisks2` Debian:12	before 2.1.3-1	2.1.3-1
`udisks2` Debian:13	before 2.1.3-1	2.1.3-1
`udisks2` Debian:14	before 2.1.3-1	2.1.3-1
`udisks` Debian:6.0	before 1.0.1+git20100614-3squeeze1, plus listed versions 1.0.1+git20100614-3	1.0.1+git20100614-3squeeze1
`udisks` Debian:7	before 1.0.4-7wheezy1, plus listed versions 1.0.4-7	1.0.4-7wheezy1
`udisks` Mageia:3	before 1.0.4-10.1.mga3	1.0.4-10.1.mga3
`udisks2` Mageia:3	before 2.0.1-2.1.mga3	2.0.1-2.1.mga3
`udisks` Mageia:4	before 1.0.4-11.1.mga4	1.0.4-11.1.mga4
`udisks2` Mageia:4	before 2.1.1-2.1.mga4	2.1.1-2.1.mga4
`udisks` Red Hat:enterprise_linux:6::client	before 0:1.0.1-7.el6_5	0:1.0.1-7.el6_5

Show 17 moreShow less

Affected packages
Package	Affected	Fixed
`udisks-debuginfo` Red Hat:enterprise_linux:6::client	before 0:1.0.1-7.el6_5	0:1.0.1-7.el6_5
`udisks-devel` Red Hat:enterprise_linux:6::client	before 0:1.0.1-7.el6_5	0:1.0.1-7.el6_5
`udisks-devel-docs` Red Hat:enterprise_linux:6::client	before 0:1.0.1-7.el6_5	0:1.0.1-7.el6_5
`udisks` Red Hat:enterprise_linux:6::computenode	before 0:1.0.1-7.el6_5	0:1.0.1-7.el6_5
`udisks-debuginfo` Red Hat:enterprise_linux:6::computenode	before 0:1.0.1-7.el6_5	0:1.0.1-7.el6_5
`udisks-devel` Red Hat:enterprise_linux:6::computenode	before 0:1.0.1-7.el6_5	0:1.0.1-7.el6_5
`udisks-devel-docs` Red Hat:enterprise_linux:6::computenode	before 0:1.0.1-7.el6_5	0:1.0.1-7.el6_5
`udisks` Red Hat:enterprise_linux:6::server	before 0:1.0.1-7.el6_5	0:1.0.1-7.el6_5
`udisks-debuginfo` Red Hat:enterprise_linux:6::server	before 0:1.0.1-7.el6_5	0:1.0.1-7.el6_5
`udisks-devel` Red Hat:enterprise_linux:6::server	before 0:1.0.1-7.el6_5	0:1.0.1-7.el6_5
`udisks-devel-docs` Red Hat:enterprise_linux:6::server	before 0:1.0.1-7.el6_5	0:1.0.1-7.el6_5
`udisks` Red Hat:enterprise_linux:6::workstation	before 0:1.0.1-7.el6_5	0:1.0.1-7.el6_5
`udisks-debuginfo` Red Hat:enterprise_linux:6::workstation	before 0:1.0.1-7.el6_5	0:1.0.1-7.el6_5
`udisks-devel` Red Hat:enterprise_linux:6::workstation	before 0:1.0.1-7.el6_5	0:1.0.1-7.el6_5
`udisks-devel-docs` Red Hat:enterprise_linux:6::workstation	before 0:1.0.1-7.el6_5	0:1.0.1-7.el6_5
`udisks` openSUSE:Tumbleweed From an advisory covering 3 CVEs	before 1.0.5-5.10	1.0.5-5.10
`udisks2` openSUSE:Tumbleweed	before 2.1.8-1.1	2.1.8-1.1

What each source reports

NVD Score used6.9

Stack-based buffer overflow in udisks before 1.0.5 and 2.x before 2.1.3 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long mount point.

Record: CVE-2014-0004
CVSS 2.0: 6.9 MediumAV:L/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-119
Updated: 2026-11-02

CVE ListNo score

Stack-based buffer overflow in udisks before 1.0.5 and 2.x before 2.1.3 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long mount point.

Record: CVE-2014-0004
Updated: 2026-11-02

EUVDEUVD-2014-0109No score

Stack-based buffer overflow in udisks before 1.0.5 and 2.x before 2.1.3 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long mount point.

Record: EUVD-2014-0109
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jqwr-w7rw-fwpfNo score

Stack-based buffer overflow in udisks before 1.0.5 and 2.x before 2.1.3 allows local users to...

Stack-based buffer overflow in udisks before 1.0.5 and 2.x before 2.1.3 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long mount point.

Record: GHSA-jqwr-w7rw-fwpf
Weakness: CWE-119
Updated: 2026-11-02

OSVNo score

Stack-based buffer overflow in udisks before 1.0.5 and 2.x before 2.1.3 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long mount point.

Record: CVE-2014-0004
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-0004No score

Stack-based buffer overflow in udisks before 1.0.5 and 2.x before 2.1.3 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long mount point.

Record: DEBIAN-CVE-2014-0004
Updated: 2026-11-02

OSVMGASA-2014-0129No score

Updated udisks and udisks2 packages fixes security vulnerability

A flaw was found in the way udisks and udisks2 handled long path names. A malicious, local user could use this flaw to create a specially-crafted directory structure that could lead to arbitrary code execution with the privileges of the udisks daemon (root) (CVE-2014-0004).

Record: MGASA-2014-0129
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10408-1No score

udisks-1.0.5-5.10 on GA media

These are all security issues fixed in the udisks-1.0.5-5.10 package on the GA media of openSUSE Tumbleweed.