CVEvulnerability

CVE-2014-2885

7.1 HIGH Published 2018-03-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-03-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.1 HIGH — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0 ([email protected])
3.6 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:P
Weaknesses
CWE-190, CWE-200, CWE-400

Description

Multiple integer overflows in TrueCrypt 7.1a allow local users to (1) obtain sensitive information via vectors involving a crafted item->OriginalLength value in the MainThreadProc function in EncryptedIoQueue.c or (2) cause a denial of service (memory consumption) via vectors involving large StartingOffset and Length values in the ProcessVolumeDeviceControlIrp function in Ntdriver.c.

Affected configurations

• truecrypt project truecrypt 7.1

Related

Weakness · CWE (3)

  • CWE-190 Integer Overflow or Wraparound weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References