What is CVE-2014-8768?

CVE-2014-8768 is a vulnerability in Oracle Solaris, classified under Integer Underflow. Published 2014-11-20.

Is CVE-2014-8768 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Integer overflow in Oracle Solaris

CVE-2014-8768

Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow remote attackers to cause a denial of service (segmentation fault and crash) via a crafted length value in a Geonet frame.

Published 2014-11-20 · last modified 2026-06-17.

CVSS v2 metric

CVSS v2 base score 5.0 (Medium). Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.198 (97.3th percentile), scored 2026-09-28.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.198 · newest: 0.198 · change: 0.000

Affected products

Oracle Solaris — versions 11.2
Canonical Ubuntu Linux — versions 10.04, 12.04, 14.04
openSUSE — versions 13.1, 13.2
Red Hat Tcpdump — versions 4.5.0, 4.5.1, 4.5.2

Weakness classification (CWE)

CWE-191 — Integer Underflow

Public proof-of-concept exploits

References

www.exploit-db.com/exploits/35359 (Exploit, VDB Entry, Third Party Advisory, exploit)
lists.opensuse.org/opensuse-updates/2015-02/msg00062.html (vendor-advisory, Third Party Advisory)
www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html (Third Party Advisory)
packetstormsecurity.com/files/129156/tcpdump-4.6.2-Geonet-Denial-Of-Service.html (Exploit, VDB Entry, Third Party Advisory)
www.ubuntu.com/usn/USN-2433-1 (vendor-advisory, Third Party Advisory)
seclists.org/fulldisclosure/2014/Nov/48 (mailing-list, Exploit, VDB Entry, Third Party Advisory)
www.securityfocus.com/bid/71155 (VDB Entry, Third Party Advisory, vdb-entry)
exchange.xforce.ibmcloud.com/vulnerabilities/98766 (vdb-entry)
www.securityfocus.com/archive/1/534010/100/0/threaded (mailing-list)

Frequently asked questions

What is CVE-2014-8768?: CVE-2014-8768 is a vulnerability in Oracle Solaris, classified under Integer Underflow. Published 2014-11-20.
Is CVE-2014-8768 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.