CVE-2014-4909: Canonical Ubuntu Linux

Medium severity, CVSS 6.8. EPSS: 5.4% chance of exploitation in the next 30 days.

Integer overflow in the tr_bitfieldEnsureNthBitAlloced function in bitfield.c in Transmission before 2.84 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted peer message, which triggers an out-of-bounds write.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 13.10 only; version 14.04 only
• Fedoraproject Fedora: version 20 only
• Gentoo Linux: any version
• Transmissionbt Transmission: up to and including 2.83; version 0.1 only; version 0.2 only; version 0.3 only; version 0.4 only; version 0.5 only; …

Published 2014-07-29. Last modified 2026-06-17.