What is CVE-2014-4608?

CVE-2014-4608 is a high-severity vulnerability in Linux Kernel, classified under Integer Overflow or Wraparound. CVSS score: 7.3/10. Published 2014-07-03.

How severe is CVE-2014-4608?

High severity. CVSS v3 base score is 7.3 out of 10.

Integer overflow in Linux Kernel

CVE-2014-4608

Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run. NOTE: the author of the LZO algorithms says "the Linux kernel is *not* affected; media hype.

Vulnerability class: Integer Overflow

Published 2014-07-03 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

EPSS exploit prediction

EPSS: 0.054 (92.7th percentile), scored 2026-10-23.

Low probability of exploitation in the next 30 days, but still tracked. 93rd percentile — 92.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.054 · newest: 0.054 · change: 0.000

Affected products

Linux Kernel
Canonical Ubuntu Linux — versions 10.04, 12.04, 14.04
openSUSE — versions 11.4
SUSE Linux Enterprise Real Time Extension — versions 11
SUSE Linux Enterprise Server — versions 11

Weakness classification (CWE)

CWE-190 — Integer Overflow or Wraparound

References

www.securitymouse.com/lms-2014-06-16-2 (Broken Link)
lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html (vendor-advisory, Mailing List, Third Party Advisory)
www.ubuntu.com/usn/USN-2418-1 (vendor-advisory, Third Party Advisory)
rhn.redhat.com/errata/RHSA-2015-0062.html (vendor-advisory, Third Party Advisory)
github.com/torvalds/linux/commit/206a81c18401c0cde6e579164f752c4b147324ce (Patch, Third Party Advisory)
bugzilla.redhat.com/show_bug.cgi (Third Party Advisory, Issue Tracking)
www.ubuntu.com/usn/USN-2416-1 (vendor-advisory, Third Party Advisory)
www.ubuntu.com/usn/USN-2417-1 (vendor-advisory, Third Party Advisory)
www.securityfocus.com/bid/68214 (VDB Entry, Third Party Advisory, vdb-entry)
www.ubuntu.com/usn/USN-2419-1 (vendor-advisory, Third Party Advisory)

Frequently asked questions

What is CVE-2014-4608?: CVE-2014-4608 is a high-severity vulnerability in Linux Kernel, classified under Integer Overflow or Wraparound. CVSS score: 7.3/10. Published 2014-07-03.
How severe is CVE-2014-4608?: High severity. CVSS v3 base score is 7.3 out of 10.