CVE-2014-7913

medium

Published 2015-07-30 · Modified 2026-05-06

CVSS v3

—

CVSS v2

6.8

VIR risk

6.8

Description

The print_option function in dhcp-common.c in dhcpcd through 6.9.1, as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other products, misinterprets the return value of the snprintf function, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted message.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2014-7913

OS impact

OS	Version	Status	Fixed in
debian	bookworm	fixed	`7.0.8-0.1`
debian	bullseye	fixed	`7.0.8-0.1`

Application impact

Vendor	Product	Versions	Fixed
dhcpcd_project	dhcpcd	`{"endIncluding":"6.9.0"}`

References

http://www.securitytracker.com/id/1033124
https://android.googlesource.com/platform/external/dhcpcd/+/73c09dd8067250734511d955d8f792b41c7213f0
https://security-tracker.debian.org/tracker/CVE-2014-7913

CWEs

CWE-119

Verify integrity in audit chain (admin only). AS-IS.