CVE-2014-2892

High

Published: 22/04/2014(UTC)Translated: 17/06/2026(UTC)NVD NIST

Summary

CVE-2014-2892 involves a heap-based buffer overflow in the get_answer function in mmsh.c in libmms before version 0.6.4. This allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response.

Risk Assessment

An attacker can exploit this vulnerability to execute arbitrary code remotely, potentially leading to system compromise or data leakage. Organizations should be aware of the risks associated with using vulnerable versions of the library.

Recommendation

It is recommended to update the libmms library to version 0.6.4 or later to mitigate this vulnerability. Additionally, monitoring and restricting access to MMSH servers is advisable.

Other vulnerabilities in libmms

CVE-2006-2200Medium
Stack-based buffer overflow in the libmms library, as used by MiMMS 0.0.9 and xine-lib 1.1.0 and earlier. A remote attacker can cause a denial of service (application crash) and possibly execute arbitrary code via the send_command, string_utf16, get_data, and get_media_packet functions.

Original NVD description (English source)

Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS