CVE-2014-8625 Memory corruption in n/a

What is CVE-2014-8625?

CVE-2014-8625 is a medium-severity memory corruption vulnerability in n/a, published on 20 Jan 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) package or (2) architecture name.

Weakness: CWE-134

Which versions are affected by CVE-2014-8625?

It affects 1 product.

Products include Debian Dpkg.

How do I fix CVE-2014-8625?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2014-8625 being exploited?

There is no known exploitation of CVE-2014-8625 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2017-8283 Path traversal in n/a Critical 9.8
• CVE-2025-6297 dpkg-deb: Fix cleanup for control member with restricted directories High 8.2
• CVE-2026-2219 Denial of service in dpkg High 7.5
• CVE-2004-2768 Privilege escalation in n/a High 7.2
• CVE-2014-3127 Path traversal in n/a High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2014-8625, GHSA-rg28-4v7w-vh73, UBUNTU-CVE-2014-8625.