CVE-2014-0050: Commons fileupload Denial of Service Vulnerability

Q: What is CVE-2014-0050?

CVE-2014-0050 is a security vulnerability in Commons fileupload involving Commons FileUpload Denial of service vulnerability under CWE-20: Improper Input Validation.

Q: Which Commons fileupload versions are affected?

Affected versions include releases prior to 1.3.1, 8.0.3, 7.0.52 across affected packages: commons-fileupload:commons-fileupload, org.apache.tomcat:tomcat.

Q: What version fixes CVE-2014-0050?

Upgrading to 1.3.1, 8.0.3, 7.0.52 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is commons-fileupload affected?

Yes, commons-fileupload:commons-fileupload is affected in releases prior to 1.3.1. Upgrade your dependency to 1.3.1 or later.

Q: Is tomcat affected?

Yes, org.apache.tomcat:tomcat is affected in releases prior to 8.0.3, 7.0.52. Upgrade your dependency to 8.0.3, 7.0.52 or later.

Q: What CWE is associated with CVE-2014-0050?

CVE-2014-0050 is classified under CWE-20: Improper Input Validation (The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.).

Q: How can I check Maven dependencies for CVE-2014-0050?

Run the dependency tree command: 'mvn dependency:tree -Dincludes=commons-fileupload'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-xx68-jfcg-xmmf

CWE-20

Published 2018-12-21

Advisory Summary

CVE-2014-0050 is a HIGH denial of service vulnerability (CWE-20: Improper Input Validation) affecting Commons fileupload libraries in the Maven ecosystem. The issue involves commons fileupload denial of service vulnerability. Remediation is available by upgrading affected packages to version 1.3.1, 8.0.3, 7.0.52.

CVE-2014-0050 at a Glance

CVE Identifier CVE-2014-0050

GHSA Identifier GHSA-xx68-jfcg-xmmf

Severity HIGH

CVSS v3.1 Base Score N/A

CWE Classification CWE-20: Improper Input Validation

Affected Product Commons fileupload

Package Ecosystem Maven

Published Date 2018-12-21

Last Updated 2024-03-05

How to Fix CVE-2014-0050

To remediate this vulnerability, upgrade all affected Commons fileupload dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

commons-fileupload:commons-fileupload fixed: 1.3.1

<dependency>
    <groupId>commons-fileupload</groupId>
    <artifactId>commons-fileupload</artifactId>
    <version>1.3.1</version>
</dependency>

org.apache.tomcat:tomcat fixed: 8.0.3

<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat</artifactId>
    <version>8.0.3</version>
</dependency>

org.apache.tomcat:tomcat fixed: 7.0.52

<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat</artifactId>
    <version>7.0.52</version>
</dependency>

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

mvn dependency:tree -Dincludes=commons-fileupload

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2014-0050, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=commons-fileupload

Analyze the terminal output to locate any version of Commons fileupload in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.3.1), your application is affected.

Note: The mvn dependency:tree -Dincludes=commons-fileupload command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-20: Improper Input Validation, where the product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. In Commons fileupload, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.

CVE-2014-0050 Affected Commons fileupload Versions

3 component(s)

Fixed Versions:

1.3.18.0.37.0.52

Product / Package	Ecosystem	Affected Versions	Fixed Version
commons-fileupload:commons-fileupload maven/commons-fileupload/commons-fileupload	Maven	< 1.3.1	1.3.1
org.apache.tomcat:tomcat maven/org.apache.tomcat/tomcat	Maven	≥ 8.0.0-RC1 < 8.0.3	8.0.3
org.apache.tomcat:tomcat maven/org.apache.tomcat/tomcat	Maven	≥ 7.0.0 < 7.0.52	7.0.52

References

NVD — CVE-2014-0050 NVD

https://nvd.nist.gov/vuln/detail/CVE-2014-0050

Security Fix Commit FIX COMMIT

https://github.com/apache/commons-fileupload/commit/c61ff05b3241cb14d989b67209e57aa71540417a

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/29384723d8d9645b87e05be9fa369a4deeb78b9c

bugzilla.redhat.com/show_bug.cgi WEB

https://bugzilla.redhat.com/show_bug.cgi?id=1062337

GitHub Advisory / Wiki ADVISORY

https://github.com/advisories/GHSA-xx68-jfcg-xmmf

Commons fileupload Source Repository REPOSITORY

https://github.com/apache/commons-fileupload

h20566.www2.hpe.com/portal/site/hpsc/pu... WEB

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755

h20566.www2.hpe.com/portal/site/hpsc/pu... WEB

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917

h20566.www2.hpe.com/portal/site/hpsc/pu... WEB

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722

svn.apache.org/viewvc WEB

https://svn.apache.org/viewvc?view=revision&revision=1565143

svn.apache.org/viewvc WEB

https://svn.apache.org/viewvc?view=revision&revision=1565163

svn.apache.org/viewvc WEB

https://svn.apache.org/viewvc?view=revision&revision=1565169

Commons fileupload Security Information SECURITY

https://tomcat.apache.org/security-7.html

Commons fileupload Security Information SECURITY

https://tomcat.apache.org/security-8.html

advisories.mageia.org/mgasa-2014-0110.htm... WEB

http://advisories.mageia.org/MGASA-2014-0110.html

blog.spiderlabs.com/2014/02/cve-2014-00... WEB

http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html

jvn.jp/en/jp/jvn14876762/i... WEB

http://jvn.jp/en/jp/JVN14876762/index.html

jvndb.jvn.jp/jvndb/jvndb-2014-00... WEB

http://jvndb.jvn.jp/jvndb/JVNDB-2014-000017

mail-archives.apache.org/mod_mbox/commons-de... WEB

http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907@apache.org%3E

marc.info/ WEB

http://marc.info/?l=bugtraq&m=143136844732487&w=2

Commons fileupload Security Information SECURITY

http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html

rhn.redhat.com/errata/rhsa-2014-02... WEB

http://rhn.redhat.com/errata/RHSA-2014-0252.html

rhn.redhat.com/errata/rhsa-2014-02... WEB

http://rhn.redhat.com/errata/RHSA-2014-0253.html

rhn.redhat.com/errata/rhsa-2014-04... WEB

http://rhn.redhat.com/errata/RHSA-2014-0400.html

seclists.org/fulldisclosure/2014... WEB

http://seclists.org/fulldisclosure/2014/Dec/23

secunia.com/advisories/57915 WEB

http://secunia.com/advisories/57915

secunia.com/advisories/58075 WEB

http://secunia.com/advisories/58075

secunia.com/advisories/58976 WEB

http://secunia.com/advisories/58976

secunia.com/advisories/59039 WEB

http://secunia.com/advisories/59039

secunia.com/advisories/59041 WEB

http://secunia.com/advisories/59041

secunia.com/advisories/59183 WEB

http://secunia.com/advisories/59183

secunia.com/advisories/59184 WEB

http://secunia.com/advisories/59184

secunia.com/advisories/59185 WEB

http://secunia.com/advisories/59185

secunia.com/advisories/59187 WEB

http://secunia.com/advisories/59187

secunia.com/advisories/59232 WEB

http://secunia.com/advisories/59232

secunia.com/advisories/59399 WEB

http://secunia.com/advisories/59399

secunia.com/advisories/59492 WEB

http://secunia.com/advisories/59492

secunia.com/advisories/59500 WEB

http://secunia.com/advisories/59500

secunia.com/advisories/59725 WEB

http://secunia.com/advisories/59725

secunia.com/advisories/60475 WEB

http://secunia.com/advisories/60475

secunia.com/advisories/60753 WEB

http://secunia.com/advisories/60753

svn.apache.org/r1565143 WEB

http://svn.apache.org/r1565143

Commons fileupload Security Information SECURITY

http://tomcat.apache.org/security-7.html

Commons fileupload Security Information SECURITY

http://tomcat.apache.org/security-8.html

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21669554

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21675432

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21676091

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21676092

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21676401

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21676403

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21676405

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21676410

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21676656

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21676853

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21677691

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21677724

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21681214

Commons fileupload Security Information SECURITY

http://www.debian.org/security/2014/dsa-2856

Commons fileupload Security Information SECURITY

http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html

Commons fileupload Security Information SECURITY

http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html

Commons fileupload Security Information SECURITY

http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html

Commons fileupload Security Information SECURITY

http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm

Commons fileupload Security Information SECURITY

http://www.mandriva.com/security/advisories?name=MDVSA-2015:084

Commons fileupload Security Information SECURITY

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Commons fileupload Security Information SECURITY

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Commons fileupload Security Information SECURITY

http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html

Commons fileupload Security Information SECURITY

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

Commons fileupload Security Information SECURITY

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Commons fileupload Security Information SECURITY

http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

Commons fileupload Security Information SECURITY

http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html

Commons fileupload Security Information SECURITY

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Commons fileupload Security Information SECURITY

http://www.securityfocus.com/archive/1/532549/100/0/threaded

Commons fileupload Security Information SECURITY

http://www.securityfocus.com/archive/1/534161/100/0/threaded

Commons fileupload Security Information SECURITY

http://www.securityfocus.com/bid/65400

www.ubuntu.com/usn/usn-2130-1 WEB

http://www.ubuntu.com/usn/USN-2130-1

Commons fileupload Security Information SECURITY

http://www.vmware.com/security/advisories/VMSA-2014-0007.html

Commons fileupload Security Information SECURITY

http://www.vmware.com/security/advisories/VMSA-2014-0008.html

Commons fileupload Security Information SECURITY

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Frequently Asked Questions

What is CVE-2014-0050?

CVE-2014-0050 is a security vulnerability in Commons fileupload involving Commons FileUpload Denial of service vulnerability under CWE-20: Improper Input Validation.

Which Commons fileupload versions are affected?

Affected versions include releases prior to 1.3.1, 8.0.3, 7.0.52 across affected packages: commons-fileupload:commons-fileupload, org.apache.tomcat:tomcat.

What version fixes CVE-2014-0050?

Upgrading to 1.3.1, 8.0.3, 7.0.52 (or the latest patched release for your respective branch) resolves the vulnerability.

Is commons-fileupload affected?

Yes, commons-fileupload:commons-fileupload is affected in releases prior to 1.3.1. Upgrade your dependency to 1.3.1 or later.

Is tomcat affected?

Yes, org.apache.tomcat:tomcat is affected in releases prior to 8.0.3, 7.0.52. Upgrade your dependency to 8.0.3, 7.0.52 or later.

What CWE is associated with CVE-2014-0050?

CVE-2014-0050 is classified under CWE-20: Improper Input Validation (The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.).

How can I check Maven dependencies for CVE-2014-0050?

Run the dependency tree command: 'mvn dependency:tree -Dincludes=commons-fileupload'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xx68-jfcg-xmmf",
  "modified" : "2024-03-05T19:13:45Z",
  "published" : "2018-12-21T17:51:42Z",
  "aliases" : [ "CVE-2014-0050" ],
  "summary" : "Commons FileUpload Denial of service vulnerability",
  "details" : "MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "commons-fileupload:commons-fileupload"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.3.1"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat:tomcat"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "8.0.0-RC1"
      }, {
        "fixed" : "8.0.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 8.0.1"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat:tomcat"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "7.0.0"
      }, {
        "fixed" : "7.0.52"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 7.0.50"
    }
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2014-0050"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/commons-fileupload/commit/c61ff05b3241cb14d989b67209e57aa71540417a"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/29384723d8d9645b87e05be9fa369a4deeb78b9c"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1062337"
  }, {
    "type" : "ADVISORY",
    "url" : "https://github.com/advisories/GHSA-xx68-jfcg-xmmf"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/apache/commons-fileupload"
  }, {
    "type" : "WEB",
    "url" : "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"
  }, {
    "type" : "WEB",
    "url" : "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917"
  }, {
    "type" : "WEB",
    "url" : "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722"
  }, {
    "type" : "WEB",
    "url" : "https://svn.apache.org/viewvc?view=revision&revision=1565143"
  }, {
    "type" : "WEB",
    "url" : "https://svn.apache.org/viewvc?view=revision&revision=1565163"
  }, {
    "type" : "WEB",
    "url" : "https://svn.apache.org/viewvc?view=revision&revision=1565169"
  }, {
    "type" : "WEB",
    "url" : "https://tomcat.apache.org/security-7.html"
  }, {
    "type" : "WEB",
    "url" : "https://tomcat.apache.org/security-8.html"
  }, {
    "type" : "WEB",
    "url" : "http://advisories.mageia.org/MGASA-2014-0110.html"
  }, {
    "type" : "WEB",
    "url" : "http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html"
  }, {
    "type" : "WEB",
    "url" : "http://jvn.jp/en/jp/JVN14876762/index.html"
  }, {
    "type" : "WEB",
    "url" : "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000017"
  }, {
    "type" : "WEB",
    "url" : "http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907@apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "http://marc.info/?l=bugtraq&m=143136844732487&w=2"
  }, {
    "type" : "WEB",
    "url" : "http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html"
  }, {
    "type" : "WEB",
    "url" : "http://rhn.redhat.com/errata/RHSA-2014-0252.html"
  }, {
    "type" : "WEB",
    "url" : "http://rhn.redhat.com/errata/RHSA-2014-0253.html"
  }, {
    "type" : "WEB",
    "url" : "http://rhn.redhat.com/errata/RHSA-2014-0400.html"
  }, {
    "type" : "WEB",
    "url" : "http://seclists.org/fulldisclosure/2014/Dec/23"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/57915"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/58075"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/58976"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59039"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59041"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59183"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59184"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59185"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59187"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59232"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59399"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59492"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59500"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59725"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/60475"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/60753"
  }, {
    "type" : "WEB",
    "url" : "http://svn.apache.org/r1565143"
  }, {
    "type" : "WEB",
    "url" : "http://tomcat.apache.org/security-7.html"
  }, {
    "type" : "WEB",
    "url" : "http://tomcat.apache.org/security-8.html"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21669554"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21675432"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21676091"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21676092"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21676401"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21676403"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21676405"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21676410"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21676656"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21676853"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21677691"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21677724"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21681214"
  }, {
    "type" : "WEB",
    "url" : "http://www.debian.org/security/2014/dsa-2856"
  }, {
    "type" : "WEB",
    "url" : "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm"
  }, {
    "type" : "WEB",
    "url" : "http://www.mandriva.com/security/advisories?name=MDVSA-2015:084"
  }, {
    "type" : "WEB",
    "url" : "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.securityfocus.com/archive/1/532549/100/0/threaded"
  }, {
    "type" : "WEB",
    "url" : "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
  }, {
    "type" : "WEB",
    "url" : "http://www.securityfocus.com/bid/65400"
  }, {
    "type" : "WEB",
    "url" : "http://www.ubuntu.com/usn/USN-2130-1"
  }, {
    "type" : "WEB",
    "url" : "http://www.vmware.com/security/advisories/VMSA-2014-0007.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.vmware.com/security/advisories/VMSA-2014-0008.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-06-16T22:04:56Z",
    "nvd_published_at" : "2014-04-01T06:27:00Z"
  }
}

Advisory Metadata

Source ID: GHSA-xx68-jfcg-xmmf
Schema Version: 1.4.0
Published: 2018-12-21 17:51
Last Modified: 2024-03-05 19:13
Database Record File: advisories/github-reviewed/2018/12/GHSA-xx68-jfcg-xmmf/GHSA-xx68-jfcg-xmmf.json