CVE-2014-4609 — Vulnetix

CVE-2014-4609 PUBLISHED

Integer overflow in the get_len function in libavutil/lzo.c in Libav before 0.8.13, 9.x before 9.14, and 10.x before 10.2 allows remote attackers to execute arbitrary code via a crafted Literal Run.

EPSS 2.15% · 84.6th percentile

Risk Scores

EPSS Score

2.15%

84.6th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:14.04:LTS	libav	0, 6:0.8.7-1ubuntu2, 6:9.10-1ubuntu1

Exploit Intelligence

http://www.openwall.com/lists/oss-security/2014/06/26/22 (circl)
https://libav.org/news/#2014-06-27 (circl)
http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html (vulncheck-nvd)

Timeline

Jan 14, 2020 CVE Published
Feb 4, 2022 EPSS Score
Mar 7, 2023 EPSS Score
Apr 4, 2024 CVE Updated
Dec 17, 2024 EPSS Score
Mar 17, 2025 EPSS Score
Mar 24, 2025 EPSS Score
Mar 25, 2025 EPSS Score
Mar 27, 2025 EPSS Score
Mar 28, 2025 EPSS Score
Apr 2, 2025 EPSS Score
Apr 12, 2025 EPSS Score

References

https://ubuntu.com/security/CVE-2014-4609 third-party-advisory
http://git.libav.org/?p=libav.git;a=commit;h=ccda51b14c0fcae2fad73a24872dce75a7964996 third-party-advisory
https://ubuntu.com/security/notices/USN-2277-1 vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2014-4609 third-party-advisory

Open in Interactive Console →