CVE-2014-4608

Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run. NOTE: the author of the LZO algorithms says "the Linux kernel is *not* affected; media hype.

Published: 2014-07-03 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2014-4608 is rated Moderate Risk (58.1/100): CVSS High severity, with high exploitation likelihood (EPSS 5.42%, 92th percentile). EPSS ranks this CVE among the most likely to be exploited in the near term. High exploitation likelihood—assess exposure and prioritize remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2014-4608

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 8.60% 5.42% -3.18%
2 2026-03-04 8.10% 8.60% +0.50%
3 2026-03-01 — 8.10% —

Full EPSS history (35 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2014-4608

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.3 3.1 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:L)
Attackers could change some data, but it’s limited—not everything goes.
Availability (A:L)
Might cause slowdowns, glitches, or partial disruption—not a full brick.
 3.9 3.4 134c704f-9b21-4f2e-91b3-4a467353bcc0
7.5 2.0 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:P)
Partial availability impact.
 10.0 6.4 [email protected]

Weakness enumeration for CVE-2014-4608

OS Trackers for CVE-2014-4608

vendor priority summary link
debian unimportant CVE-2014-4608 unimportant priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2014-4608
redhat low — https://access.redhat.com/security/cve/CVE-2014-4608
ubuntu medium CVE-2014-4608 medium priority: Ubuntu including 30 source packages (linux, linux-armadaxp, …), 295 status rows across 11 suites (lucid, precise, saucy, trusty, upstream, utopic, vivid, wily, xenial, yakkety, zesty): DNE 205, released 40, ignored 32, not-affected 18. https://ubuntu.com/security/CVE-2014-4608

Affected software / configurations for CVE-2014-4608

Vendor Product Version Raw CPE
linux linux_kernel < 3.15.2 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
opensuse opensuse 11.4 cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
suse linux_enterprise_real_time_extension 11 cpe:2.3:o:suse:linux_enterprise_real_time_extension:11:sp3:*:*:*:*:*:*
suse linux_enterprise_server 11 cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*
canonical ubuntu_linux 10.04 cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
canonical ubuntu_linux 12.04 cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
canonical ubuntu_linux 14.04 cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
canonical ubuntu_linux 14.10 cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*

References for CVE-2014-4608

URL Tags
http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html Third Party Advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=206a81c18401c0cde6e579164f752c4b147324ce
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html Mailing List Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0062.html Third Party Advisory
http://secunia.com/advisories/60011 Third Party Advisory
http://secunia.com/advisories/60174 Third Party Advisory
http://secunia.com/advisories/62633 Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.2 Release Notes Vendor Advisory
http://www.oberhumer.com/opensource/lzo/ Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/06/26/21 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/68214 Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-2416-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2417-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2418-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2419-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2420-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2421-1 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1113899 Issue Tracking Third Party Advisory
https://github.com/torvalds/linux/commit/206a81c18401c0cde6e579164f752c4b147324ce Patch Third Party Advisory
https://www.securitymouse.com/lms-2014-06-16-2 Broken Link
cvelogic Threat Intelligence