CVE-2014-1878

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-02-28 · updated 2026-06-17
Weakness: CWE-119

Description

Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.

Affected products

icinga2: through 1.8.5; 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.9.0 (+7)
Nagios Enterprises nagios: through 4.0.3; 4.0.0-beta1, 4.0.0-beta2, 4.0.0-beta3, 4.0.0-beta4, 4.0.2

References

http://lists.opensuse.org/opensuse-updates/2014-04/msg00033.html
http://secunia.com/advisories/57024
http://www.securityfocus.com/bid/65605
https://bugzilla.redhat.com/show_bug.cgi?id=1066578
https://dev.icinga.org/issues/5434
https://lists.debian.org/debian-lts-announce/2018/12/msg00014.html
https://www.icinga.org/2014/02/11/bugfix-releases-1-10-3-1-9-5-1-8-6
http://lists.opensuse.org/opensuse-updates/2014-04/msg00033.html
http://secunia.com/advisories/57024
http://www.securityfocus.com/bid/65605
https://bugzilla.redhat.com/show_bug.cgi?id=1066578
https://dev.icinga.org/issues/5434

Get alerted when CVE-2014-1878 or the next vulnerability affects your stack