What’s Vulnerable › Vulnerabilities

CVE-2014-8476

• Severity: low (CVSS 2.1 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-11-13 · updated 2026-06-17
• Weakness: CWE-200

Description

The setlogin function in FreeBSD 8.4 through 10.1-RC4 does not initialize the buffer used to store the login name, which allows local users to obtain sensitive information from kernel memory via a call to getlogin, which returns the entire buffer.

Affected products

• FreeBSD: 8.4, 9.0, 9.0-beta1, 9.0-beta2, 9.1, 9.2 (+7)

References

• http://secunia.com/advisories/61118
• http://secunia.com/advisories/62218
• http://www.debian.org/security/2014/dsa-3070
• https://www.freebsd.org/security/advisories/FreeBSD-SA-14%3A25.setlogin.asc
• http://secunia.com/advisories/61118
• http://secunia.com/advisories/62218
• http://www.debian.org/security/2014/dsa-3070
• https://www.freebsd.org/security/advisories/FreeBSD-SA-14%3A25.setlogin.asc

Get alerted when CVE-2014-8476 or the next vulnerability affects your stack