Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to cause a denial of service (crash) via unspecified vectors to the (1) display_nav_table, (2) print_export_link, (3) page_num_selector, or (4) page_limit_selector function in cgi/cgiutils.c or (5) status_page_num_selector function in cgi/status.c, which triggers a stack-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade icinga | Dec 10, 2025 | Mar 29, 2014 |
| Suse | — | Upgrade icinga-docUpgrade icinga-idoutils-oracleUpgrade icingaUpgrade monitoring-tools-debuginfoUpgrade icinga-idoutils-mysqlUpgrade monitoring-toolsUpgrade icinga-idoutilsUpgrade icinga-idoutils-pgsqlUpgrade icinga-www-debuginfoUpgrade icinga-plugins-eventhandlersUpgrade icinga-wwwUpgrade icinga-plugins-downtimesUpgrade icinga-debugsourceUpgrade icinga-idoutils-debuginfoUpgrade icinga-develUpgrade icinga-debuginfo | Dec 18, 2015 | Mar 24, 2014 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub