CVE-2014-3554

medium
Published 2014-07-31 · Modified 2026-05-06
CVSS v3
CVSS v2
6.8
VIR risk
6.8

Description

Buffer overflow in the ndp_msg_opt_dnssl_domain function in libndp allows remote routers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS Search List (DNSSL) in an IPv6 router advertisement.

Predictions

Exploit likelihood
20%
Patch ETA

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2014-3554

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — https://bugzilla.redhat.com/show_bug.cgi?id=1118583

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — http://www.openwall.com/lists/oss-security/2014/07/29/2

OS impact

OSVersionStatusFixed in
debian debianbookwormfixed1.4-1
debian debianbullseyefixed1.4-1
debian debianforkyfixed1.4-1
debian debiansidfixed1.4-1
debian debiantrixiefixed1.4-1

Application impact

VendorProductVersionsFixed
libndplibndp{"endExcluding":"1.4"}1.4

References

CWEs

CWE-120

Verify integrity in audit chain (admin only). AS-IS.