{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-02-22T00:00:00", "descriptions": [{"lang": "en", "value": "The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information by reading packets."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-01-06T16:15:25", "orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "microfocus"}, "references": [{"name": "1037968", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1037968"}, {"name": "SUSE-SU-2015:0652", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/torvalds/linux/commit/338f977f4eb441e69bb9a46eaa0ac715c931a67f"}, {"name": "RHSA-2015:0290", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2015-0290.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.5"}, {"name": "SUSE-SU-2015:0481", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html"}, {"name": "openSUSE-SU-2015:0566", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html"}, {"name": "[oss-security] 20141109 Re: CVE Request: Linux kernel mac80211 plain text leak", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2014/11/09/1"}, {"name": "linux-kernel-cve20148709-info-disclsoure(98922)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98922"}, {"name": "RHSA-2015:1272", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2015-1272.html"}, {"name": "70965", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/70965"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://source.android.com/security/bulletin/2017-03-01.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=338f977f4eb441e69bb9a46eaa0ac715c931a67f"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@microfocus.com", "ID": "CVE-2014-8709", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information by reading packets."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "1037968", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1037968"}, {"name": "SUSE-SU-2015:0652", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html"}, {"name": "https://github.com/torvalds/linux/commit/338f977f4eb441e69bb9a46eaa0ac715c931a67f", "refsource": "CONFIRM", "url": "https://github.com/torvalds/linux/commit/338f977f4eb441e69bb9a46eaa0ac715c931a67f"}, {"name": "RHSA-2015:0290", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2015-0290.html"}, {"name": "http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.5", "refsource": "CONFIRM", "url": "http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.5"}, {"name": "SUSE-SU-2015:0481", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html"}, {"name": "openSUSE-SU-2015:0566", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html"}, {"name": "[oss-security] 20141109 Re: CVE Request: Linux kernel mac80211 plain text leak", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2014/11/09/1"}, {"name": "linux-kernel-cve20148709-info-disclsoure(98922)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98922"}, {"name": "RHSA-2015:1272", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2015-1272.html"}, {"name": "70965", "refsource": "BID", "url": "http://www.securityfocus.com/bid/70965"}, {"name": "https://source.android.com/security/bulletin/2017-03-01.html", "refsource": "CONFIRM", "url": "https://source.android.com/security/bulletin/2017-03-01.html"}, {"name": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=338f977f4eb441e69bb9a46eaa0ac715c931a67f", "refsource": "CONFIRM", "url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=338f977f4eb441e69bb9a46eaa0ac715c931a67f"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T13:26:02.590Z"}, "title": "CVE Program Container", "references": [{"name": "1037968", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1037968"}, {"name": "SUSE-SU-2015:0652", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/torvalds/linux/commit/338f977f4eb441e69bb9a46eaa0ac715c931a67f"}, {"name": "RHSA-2015:0290", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2015-0290.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.5"}, {"name": "SUSE-SU-2015:0481", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html"}, {"name": "openSUSE-SU-2015:0566", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html"}, {"name": "[oss-security] 20141109 Re: CVE Request: Linux kernel mac80211 plain text leak", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2014/11/09/1"}, {"name": "linux-kernel-cve20148709-info-disclsoure(98922)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98922"}, {"name": "RHSA-2015:1272", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2015-1272.html"}, {"name": "70965", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/70965"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://source.android.com/security/bulletin/2017-03-01.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=338f977f4eb441e69bb9a46eaa0ac715c931a67f"}]}]}, "cveMetadata": {"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "assignerShortName": "microfocus", "cveId": "CVE-2014-8709", "datePublished": "2014-11-10T11:00:00", "dateReserved": "2014-11-09T00:00:00", "dateUpdated": "2024-08-06T13:26:02.590Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "26187D6E-913B-49BC-9F5E-FFD7BB67A45C", "versionEndIncluding": "3.13.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.13:*:*:*:*:*:*:*", "matchCriteriaId": "50513044-C297-4D5E-BD45-6FD603A29F25", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.13.1:*:*:*:*:*:*:*", "matchCriteriaId": "531009EC-C86D-4017-BEF1-924674268F6B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.13.2:*:*:*:*:*:*:*", "matchCriteriaId": "6FBC6289-598B-429E-94CE-5D98B120B9AA", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.13.3:*:*:*:*:*:*:*", "matchCriteriaId": "4D5B7BFA-81AC-424C-A6BC-32CBBDCA6148", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information by reading packets."}, {"lang": "es", "value": "La funci\u00f3n ieee80211_fragment en net/mac80211/tx.c en el kernel de Linux anterior a 3.13.5 no mantiene debidamente cierto puntero de cola, lo que permite a atacantes remotos obtener informaci\u00f3n sensible en texto plano mediante la lectura de paquetes."}], "id": "CVE-2014-8709", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-11-10T11:55:10.017", "references": [{"source": "security@opentext.com", "url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=338f977f4eb441e69bb9a46eaa0ac715c931a67f"}, {"source": "security@opentext.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html"}, {"source": "security@opentext.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html"}, {"source": "security@opentext.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html"}, {"source": "security@opentext.com", "url": "http://rhn.redhat.com/errata/RHSA-2015-0290.html"}, {"source": "security@opentext.com", "url": "http://rhn.redhat.com/errata/RHSA-2015-1272.html"}, {"source": "security@opentext.com", "url": "http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.5"}, {"source": "security@opentext.com", "url": "http://www.openwall.com/lists/oss-security/2014/11/09/1"}, {"source": "security@opentext.com", "url": "http://www.securityfocus.com/bid/70965"}, {"source": "security@opentext.com", "url": "http://www.securitytracker.com/id/1037968"}, {"source": "security@opentext.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98922"}, {"source": "security@opentext.com", "url": "https://github.com/torvalds/linux/commit/338f977f4eb441e69bb9a46eaa0ac715c931a67f"}, {"source": "security@opentext.com", "url": "https://source.android.com/security/bulletin/2017-03-01.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=338f977f4eb441e69bb9a46eaa0ac715c931a67f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2015-0290.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2015-1272.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2014/11/09/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/70965"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1037968"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98922"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/torvalds/linux/commit/338f977f4eb441e69bb9a46eaa0ac715c931a67f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://source.android.com/security/bulletin/2017-03-01.html"}], "sourceIdentifier": "security@opentext.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2015:1272", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "kernel-0:2.6.32-573.el6", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2015-07-20T00:00:00Z"}, {"advisory": "RHSA-2015:0290", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "kernel-0:3.10.0-229.el7", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2015-03-05T00:00:00Z"}], "bugzilla": {"description": "kernel: net: mac80211: plain text information leak", "id": "1173580", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1173580"}, "csaw": false, "cvss": {"cvss_base_score": "1.8", "cvss_scoring_vector": "AV:A/AC:H/Au:N/C:P/I:N/A:N", "status": "verified"}, "details": ["The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information by reading packets.", "An information leak flaw was found in the Linux kernel's IEEE 802.11 wireless networking implementation. When software encryption was used, a remote attacker could use this flaw to leak up to 8 bytes of plaintext."], "name": "CVE-2014-8709", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/a:redhat:enterprise_mrg:2", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise MRG 2"}], "public_date": "2014-11-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2014-8709\nhttps://nvd.nist.gov/vuln/detail/CVE-2014-8709"], "statement": "This issue did not affect the version of the kernel package as shipped with Red Hat Enterprise MRG 2.\nThis issue affects the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "threat_severity": "Low"}

{}