CVE-2014-3714

The ARM image loading functionality in Xen 4.4.x does not properly validate kernel length, which allows local users to read system memory or cause a denial of service (crash) via a crafted 32-bit ARM guest kernel in an image, which triggers a buffer overflow.

• CWE-20

• http://www.openwall.com/lists/oss-security/2014/05/14/4Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2014/05/15/6Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2014/05/16/1Mailing List, Third Party Advisory
• http://www.securitytracker.com/id/1030252Third Party Advisory, VDB Entry
• http://xenbits.xen.org/xsa/advisory-95.htmlPatch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2014/05/14/4Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2014/05/15/6Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2014/05/16/1Mailing List, Third Party Advisory
• http://www.securitytracker.com/id/1030252Third Party Advisory, VDB Entry
• http://xenbits.xen.org/xsa/advisory-95.htmlPatch, Vendor Advisory

Published

May 19, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3707The curl_easy_duphandle function in libcurl 7.17.1 through 7…
• CVE-2014-3708OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before…
• CVE-2014-3709The org.keycloak.services.resources.SocialResource.callback …
• CVE-2014-3710The donote function in readelf.c in file through 5.20, as us…
• CVE-2014-3711namei in FreeBSD 9.1 through 10.1-RC2 allows remote attacker…
• CVE-2014-3712Katello allows remote attackers to cause a denial of service…
• CVE-2014-3715Buffer overflow in Xen 4.4.x allows local users to read syst…
• CVE-2014-3716Xen 4.4.x does not properly check alignment, which allows lo…
• CVE-2014-3717Xen 4.4.x does not properly validate the load address for 64…
• CVE-2014-3718Multiple cross-site scripting (XSS) vulnerabilities in cgi-b…6.1
• CVE-2014-3719Multiple SQL injection vulnerabilities in cgi-bin/review_m.c…9.8
• CVE-2014-3730The django.util.http.is_safe_url function in Django 1.4 befo…