CVE-2014-1646 Memory corruption in n/a

What is CVE-2014-1646?

CVE-2014-1646 is a low-severity memory corruption vulnerability in n/a, published on 23 Apr 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Symantec PGP Desktop 10.0.x through 10.2.x and Encryption Desktop Professional 10.3.x before 10.3.2 MP1 do not properly perform memory copies, which allows remote attackers to cause a denial of service (read access violation and application crash) via a malformed certificate.

Weakness: CWE-119

Which versions are affected by CVE-2014-1646?

It affects 2 products.

Products include Symantec Encryption Desktop, Symantec Pgp Desktop.

How do I fix CVE-2014-1646?

No fix has been published for CVE-2014-1646 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2014-1646 being exploited?

There is no known exploitation of CVE-2014-1646 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2016-6590 Privilege escalation in Encryption Desktop High 7.8
• CVE-2012-4351 Integer overflow in n/a Medium 6.9
• CVE-2013-1610 Privilege escalation in n/a Medium 6.8
• CVE-2017-6330 Denial of service in Symantec Encryption Desktop Medium 6.5
• CVE-2017-13682 Information disclosure in Symantec Encryption Desktop Medium 5.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2f9c-v7c3-mh76.