CVE-2014-3074

The runtime linker in IBM AIX 6.1 and 7.1 and VIOS 2.2.x allows local users to create a mode-666 root-owned file, and consequently gain privileges, by setting crafted MALLOCOPTIONS and MALLOCBUCKETS environment-variable values and then executing a setuid program.

• CWE-264

• http://aix.software.ibm.com/aix/efixes/security/malloc_advisory.ascVendor Advisory
• http://packetstormsecurity.com/files/127390/IBM-AIX-Runtime-Linker-Privilege-Escalation.html
• http://seclists.org/fulldisclosure/2014/Jul/31
• http://secunia.com/advisories/59344
• http://www.ibm.com/support/docview.wss?uid=isg1IV60935Vendor Advisory
• http://www.ibm.com/support/docview.wss?uid=isg1IV60940Vendor Advisory
• http://www.ibm.com/support/docview.wss?uid=isg1IV61311Vendor Advisory
• http://www.ibm.com/support/docview.wss?uid=isg1IV61313Vendor Advisory
• http://www.ibm.com/support/docview.wss?uid=isg1IV61314Vendor Advisory
• http://www.ibm.com/support/docview.wss?uid=isg1IV61315Vendor Advisory
• http://www.securityfocus.com/archive/1/532689/100/0/threaded
• http://www.securityfocus.com/bid/68296
• http://www.securitytracker.com/id/1030504
• https://exchange.xforce.ibmcloud.com/vulnerabilities/93816
• https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3074/
• http://aix.software.ibm.com/aix/efixes/security/malloc_advisory.ascVendor Advisory
• http://packetstormsecurity.com/files/127390/IBM-AIX-Runtime-Linker-Privilege-Escalation.html
• http://seclists.org/fulldisclosure/2014/Jul/31
• http://secunia.com/advisories/59344
• http://www.ibm.com/support/docview.wss?uid=isg1IV60935Vendor Advisory
• http://www.ibm.com/support/docview.wss?uid=isg1IV60940Vendor Advisory
• http://www.ibm.com/support/docview.wss?uid=isg1IV61311Vendor Advisory
• http://www.ibm.com/support/docview.wss?uid=isg1IV61313Vendor Advisory
• http://www.ibm.com/support/docview.wss?uid=isg1IV61314Vendor Advisory
• http://www.ibm.com/support/docview.wss?uid=isg1IV61315Vendor Advisory
• http://www.securityfocus.com/archive/1/532689/100/0/threaded
• http://www.securityfocus.com/bid/68296
• http://www.securitytracker.com/id/1030504
• https://exchange.xforce.ibmcloud.com/vulnerabilities/93816
• https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3074/

Published

Jul 2, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3068IBM Java Runtime Environment (JRE) 7 R1 before SR1 FP1 (7.1.…
• CVE-2014-3069Multiple CRLF injection vulnerabilities in the Universal Acc…
• CVE-2014-3070The addFileRegistryAccount Virtual Member Manager (VMM) SPI …
• CVE-2014-3071Cross-site scripting (XSS) vulnerability in the Data Quality…
• CVE-2014-3072Unspecified vulnerability in the Automation Server in IBM Se…
• CVE-2014-3073Unspecified vulnerability in IBM Security Access Manager (IS…
• CVE-2014-3075Cross-site scripting (XSS) vulnerability in IBM Business Pro…
• CVE-2014-3076IBM Business Process Manager (BPM) 8.5 through 8.5.5 allows …
• CVE-2014-3077IBM SONAS and System Storage Storwize V7000 Unified (aka V70…
• CVE-2014-3079The Administration and Reporting Tool in IBM Rational Licens…
• CVE-2014-3080Multiple cross-site scripting (XSS) vulnerabilities on IBM G…
• CVE-2014-3081prodtest.php on IBM GCM16 and GCM32 Global Console Manager s…