Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to cause a denial of service (crash) via unspecified vectors to the (1) display_nav_table, (2) print_export_link, (3) page_num_selector, or (4) page_limit_selector function in cgi/cgiutils.c or (5) status_page_num_selector function in cgi/status.c, which triggers a stack-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade icinga | Dec 10, 2025 | Mar 29, 2014 |
| Suse | — | Upgrade icinga-develUpgrade icinga-plugins-downtimesUpgrade icinga-debuginfoUpgrade icinga-wwwUpgrade icinga-debugsourceUpgrade icinga-idoutils-debuginfoUpgrade icinga-plugins-eventhandlersUpgrade icinga-idoutils-oracleUpgrade icinga-docUpgrade monitoring-toolsUpgrade icingaUpgrade icinga-idoutilsUpgrade icinga-idoutils-mysqlUpgrade monitoring-tools-debuginfoUpgrade icinga-idoutils-pgsqlUpgrade icinga-www-debuginfo | Dec 18, 2015 | Mar 24, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub