high 7.5

CVE-2014-5119 in the critical feed json

Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to…

published 2014-08-29 12y ago modified 2026-06-17 4mo ago also EUVD-2014-5017

cvss: 7.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 17.0%; EPSS 17.0% chance of exploitation in 30 days, percentile 97%
public exploits: 1; Exploit-DB

Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules.

Patch / fix

fixed in 1 distros 4

gnu glibc 2.20

debian ubuntu red hat opensuse

glibc Debian 14, Debian 13, Debian 12 2.19-10

debian advisories DEBIAN-CVE-2014-5119

eglibc Ubuntu 14.04 LTS 2.19-0ubuntu6.3

ubuntu advisories UBUNTU-CVE-2014-5119

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

glibc RHEL 5 2.5-118.el5_10.3
glibc RHEL 6 2.12-1.132.el6_5.4
glibc RHEL 7 2.17-55.el7_0.1
nscd RHEL 5 2.5-118.el5_10.3
nscd RHEL 6 2.12-1.132.el6_5.4
nscd RHEL 7 2.17-55.el7_0.1
glibc-utils RHEL 5 2.5-118.el5_10.3
glibc-utils RHEL 6 2.12-1.132.el6_5.4

red hat advisories RHSA-2014:1118 RHSA-2014:1110

glibc openSUSE Tumbleweed 2.24-2.3

opensuse advisories openSUSE-SU-2024:10154-1

Is CVE-2014-5119 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-5119 updated 2026-06-27 cvss 6.9

glibc: off-by-one error leading to a heap-based buffer overflow flaw in __gconv_translit_find()

Red Hat Enterprise Linux (v. 5 server) nscd 2.5-118.el5_10.3, glibc 2.5-118.el5_10.3, glibc-utils 2.5-118.el5_10.3, glibc-common 2.5-118.el5_10.3, glibc-debuginfo-common 2.5-118.el5_10.3 Red Hat Enterprise Linux Client (v. 7) nscd 2.17-55.el7_0.1, glibc 2.17-55.el7_0.1, glibc-utils 2.17-55.el7_0.1, glibc-common 2.17-55.el7_0.1, glibc-debuginfo-common 2.17-55.el7_0.1 Red Hat Enterprise Linux Client Optional (v. 7) glibc-debuginfo-common 2.17-55.el7_0.1
fixed: vendor fix RHSA-2014:1110
Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.4) glibc 2.12-1.107.el6_4.6, glibc-debuginfo-common 2.12-1.107.el6_4.6
fixed: vendor fix RHSA-2014:1118
Red Hat Enterprise Linux ComputeNode (v. 7) nscd 2.17-55.el7_0.1, glibc 2.17-55.el7_0.1, glibc-utils 2.17-55.el7_0.1, glibc-common 2.17-55.el7_0.1, glibc-debuginfo-common 2.17-55.el7_0.1 Red Hat Enterprise Linux ComputeNode Optional (v. 7) glibc-debuginfo-common 2.17-55.el7_0.1 Red Hat Enterprise Linux Desktop (v. 5 client) nscd 2.5-118.el5_10.3, glibc 2.5-118.el5_10.3, glibc-utils 2.5-118.el5_10.3, glibc-common 2.5-118.el5_10.3, glibc-debuginfo-common 2.5-118.el5_10.3 Red Hat Enterprise Linux Desktop (v. 6) nscd 2.12-1.132.el6_5.4, glibc 2.12-1.132.el6_5.4, glibc-utils 2.12-1.132.el6_5.4, glibc-common 2.12-1.132.el6_5.4, glibc-debuginfo-common 2.12-1.132.el6_5.4 Red Hat Enterprise Linux Desktop Optional (v. 6) glibc 2.12-1.132.el6_5.4, glibc-debuginfo-common 2.12-1.132.el6_5.4
fixed: vendor fix RHSA-2014:1110
Red Hat Enterprise Linux EUS (v. 5.9 server) nscd 2.5-107.el5_9.7, glibc 2.5-107.el5_9.7, glibc-utils 2.5-107.el5_9.7, glibc-common 2.5-107.el5_9.7, glibc-debuginfo-common 2.5-107.el5_9.7
fixed: vendor fix RHSA-2014:1118
Red Hat Enterprise Linux HPC Node (v. 6) nscd 2.12-1.132.el6_5.4, glibc 2.12-1.132.el6_5.4, glibc-utils 2.12-1.132.el6_5.4, glibc-common 2.12-1.132.el6_5.4, glibc-debuginfo-common 2.12-1.132.el6_5.4
fixed: vendor fix RHSA-2014:1110
Red Hat Enterprise Linux HPC Node EUS (v. 6.4) nscd 2.12-1.107.el6_4.6, glibc 2.12-1.107.el6_4.6, glibc-utils 2.12-1.107.el6_4.6, glibc-common 2.12-1.107.el6_4.6, glibc-debuginfo-common 2.12-1.107.el6_4.6
fixed: vendor fix RHSA-2014:1118
Red Hat Enterprise Linux HPC Node Optional (v. 6) glibc 2.12-1.132.el6_5.4, glibc-debuginfo-common 2.12-1.132.el6_5.4
fixed: vendor fix RHSA-2014:1110
Red Hat Enterprise Linux Long Life (v. 5.6 server) nscd 2.5-58.el5_6.5, glibc 2.5-58.el5_6.5, glibc-utils 2.5-58.el5_6.5, glibc-common 2.5-58.el5_6.5, glibc-debuginfo-common 2.5-58.el5_6.5
fixed: vendor fix RHSA-2014:1118

show 5 more

Red Hat Enterprise Linux Server (v. 6) nscd 2.12-1.132.el6_5.4, glibc 2.12-1.132.el6_5.4, glibc-utils 2.12-1.132.el6_5.4, glibc-common 2.12-1.132.el6_5.4, glibc-debuginfo-common 2.12-1.132.el6_5.4 Red Hat Enterprise Linux Server (v. 7) nscd 2.17-55.el7_0.1, glibc 2.17-55.el7_0.1, glibc-utils 2.17-55.el7_0.1, glibc-common 2.17-55.el7_0.1, glibc-debuginfo-common 2.17-55.el7_0.1
fixed: vendor fix RHSA-2014:1110
Red Hat Enterprise Linux Server AUS (v. 6.2) nscd 2.12-1.47.el6_2.13, glibc 2.12-1.47.el6_2.13, glibc-utils 2.12-1.47.el6_2.13, glibc-common 2.12-1.47.el6_2.13, glibc-debuginfo-common 2.12-1.47.el6_2.13 Red Hat Enterprise Linux Server EUS (v. 6.4) nscd 2.12-1.107.el6_4.6, glibc 2.12-1.107.el6_4.6, glibc-utils 2.12-1.107.el6_4.6, glibc-common 2.12-1.107.el6_4.6, glibc-debuginfo-common 2.12-1.107.el6_4.6
fixed: vendor fix RHSA-2014:1118
Red Hat Enterprise Linux Server Optional (v. 6) glibc 2.12-1.132.el6_5.4, glibc-debuginfo-common 2.12-1.132.el6_5.4 Red Hat Enterprise Linux Server Optional (v. 7) glibc-debuginfo-common 2.17-55.el7_0.1
fixed: vendor fix RHSA-2014:1110
Red Hat Enterprise Linux Server Optional AUS (v. 6.2) glibc 2.12-1.47.el6_2.13, glibc-debuginfo-common 2.12-1.47.el6_2.13 Red Hat Enterprise Linux Server Optional EUS (v. 6.4) glibc 2.12-1.107.el6_4.6, glibc-debuginfo-common 2.12-1.107.el6_4.6
fixed: vendor fix RHSA-2014:1118
Red Hat Enterprise Linux Workstation (v. 6) nscd 2.12-1.132.el6_5.4, glibc 2.12-1.132.el6_5.4, glibc-utils 2.12-1.132.el6_5.4, glibc-common 2.12-1.132.el6_5.4, glibc-debuginfo-common 2.12-1.132.el6_5.4 Red Hat Enterprise Linux Workstation (v. 7) nscd 2.17-55.el7_0.1, glibc 2.17-55.el7_0.1, glibc-utils 2.17-55.el7_0.1, glibc-common 2.17-55.el7_0.1, glibc-debuginfo-common 2.17-55.el7_0.1 Red Hat Enterprise Linux Workstation Optional (v. 6) glibc 2.12-1.132.el6_5.4, glibc-debuginfo-common 2.12-1.132.el6_5.4 Red Hat Enterprise Linux Workstation Optional (v. 7) glibc-debuginfo-common 2.17-55.el7_0.1
fixed: vendor fix RHSA-2014:1110

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2014-08-27 First public exploit (EDB-34421)
2014-08-29 Published

Exploit prediction

16.97% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-34421 glibc - NUL Byte gconv_translit_find Off-by-One local, 2014-08-27

CVSS scores

assigned by	version	score	vector
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-189 Numeric Errors

References

rhn.redhat.com /errata/RHSA-2014-1118.html
vendor-advisory, third-party-advisory
rhn.redhat.com /errata/RHSA-2014-1110.html
vendor-advisory, third-party-advisory
security.gentoo.org /glsa/201602-02
vendor-advisory, third-party-advisory
mandriva.com /security/advisories?name=MDVSA-2014:175
vendor-advisory, third-party-advisory
debian.org /security/2014/dsa-3012
vendor-advisory, third-party-advisory
tools.cisco.com /security/center/content/CiscoSecurityNotice/CVE-2014-5119
vendor-advisory, third-party-advisory
lists.opensuse.org /opensuse-security-announce/2014-09/msg00017.html
vendor-advisory, mailing-list, third-party-advisory
secunia.com /advisories/60441
third-party-advisory
openwall.com /lists/oss-security/2014/08/13/5
mailing-list, third-party-advisory
securityfocus.com /bid/69738
vdb-entry, third-party-advisory
www-01.ibm.com /support/docview.wss?uid=swg21685604
third-party-advisory
secunia.com /advisories/60345
third-party-advisory
secunia.com /advisories/61093
third-party-advisory
googleprojectzero.blogspot.com /2014/08/the-poisoned-nul-byte-2014-edition.html
third-party-advisory
openwall.com /lists/oss-security/2014/07/14/1
mailing-list, third-party-advisory
securityfocus.com /bid/68983
vdb-entry, third-party-advisory
sourceware.org /bugzilla/show_bug.cgi?id=17187
issue-tracking, third-party-advisory
code.google.com /p/google-security-research/issues/detail?id=96
third-party-advisory
seclists.org /fulldisclosure/2014/Aug/69
mailing-list, third-party-advisory
secunia.com /advisories/61074
third-party-advisory
linux.oracle.com /errata/ELSA-2015-0092.html
third-party-advisory
secunia.com /advisories/60358
third-party-advisory

Sources

CVE List CVE-2014-5119
NVD CVE-2014-5119

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json critical feed