Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.9
CVE-2014-9730: Linux Kernel Crashes from Malformed UDF Filesystem
CVE-2014-9730 · published 11 years ago
Summary
A bug in the Linux kernel's handling of UDF filesystems could cause a system crash if a specially crafted filesystem image is accessed. This affects systems running an older version of the Linux kernel. To fix this, update your kernel to version 3.18.2 or later.
What to do
- Update canonical linux to version 3.13.0-48.80.
- Update canonical linux-lts-utopic to version 3.16.0-31.41~14.04.1.
- Update debian linux to version 3.16.7-ckt4-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:14.04:LTS | canonical | linux |
< 3.13.0-48.80 Fix: upgrade to 3.13.0-48.80
|
| Ubuntu:14.04:LTS | canonical | linux-lts-utopic |
< 3.16.0-31.41~14.04.1 Fix: upgrade to 3.16.0-31.41~14.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-azure-fde-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-lowlatency-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv | All versions |
| Debian:11 | debian | linux |
< 3.16.7-ckt4-1 Fix: upgrade to 3.16.7-ckt4-1
|
| Debian:12 | debian | linux |
< 3.16.7-ckt4-1 Fix: upgrade to 3.16.7-ckt4-1
|
| Debian:13 | debian | linux |
< 3.16.7-ckt4-1 Fix: upgrade to 3.16.7-ckt4-1
|
| Debian:14 | debian | linux |
< 3.16.7-ckt4-1 Fix: upgrade to 3.16.7-ckt4-1
|
| – | linux | linux_kernel |
<= 3.18.1 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
Original advisory text
The udf_pc_to_char function in fs/udf/symlink.c in the Linux kernel before 3.18.2 relies on component lengths that are unused, which allows local users to cause a denial of service (system crash) v...
The udf_pc_to_char function in fs/udf/symlink.c in the Linux kernel before 3.18.2 relies on component lengths that are unused, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.
References
- https://ubuntu.com/security/CVE-2014-9730 Third Party Advisory
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e237e... Third Party Advisory
- http://www.openwall.com/lists/oss-security/2015/06/02/7 Third Party Advisory
- https://ubuntu.com/security/notices/USN-2517-1 Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e237ec...
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.2 Vendor Advisory
- http://www.securityfocus.com/bid/74964
- https://bugzilla.redhat.com/show_bug.cgi?id=1228229
- https://github.com/torvalds/linux/commit/e237ec37ec154564f8690c5bd1795339955eeef...
- https://ubuntu.com/security/notices/USN-2542-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-2543-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-2544-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2014-9730 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2014-9730 Vendor Advisory
- https://ubuntu.com/security/notices/USN-2518-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-2541-1 Vendor Advisory
Severity
4.9
Medium
Timeline
Published31 Dec 2014
Updated4 Nov 2026
First seen12 May 2026
Track software like this
Free during beta