« Volver al listado

CVE-2014-8002

Estado: ModificadaAlta (7.5)—

Use-after-free vulnerability in decode_slice.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — Openh264

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-8002",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-11-25T17:59:01.627",
  "references": [
    {
      "url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=36501",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://github.com/cisco/openh264/pull/1096/files",
      "tags": [
        "Patch"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=36501",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/cisco/openh264/pull/1096/files",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Use-after-free vulnerability in decode_slice.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de uso después de liberación en decode_slice.cpp en Cisco OpenH264 1.2.0 y anteriores permite a atacantes remotos ejecutar código arbitrario a través de un fichero de medios codificado."
    }
  ],
  "lastModified": "2026-06-17T00:16:05.203",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:openh264:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34D9EA23-79E2-47DB-A251-F442F9A34069",
              "versionEndIncluding": "1.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}