CVE-2014-8104: Canonical Ubuntu Linux

Medium severity, CVSS 6.8. EPSS: 3.5% chance of exploitation in the next 30 days.

OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 14.10 only
• Debian Debian Linux: version 7.0 only; version 8.0 only
• Mageia Mageia: version 4.0 only
• Opensuse Opensuse: version 12.3 only; version 13.1 only; version 13.2 only
• Openvpn Openvpn: version 2.0.1_rc1 only; version 2.0.1_rc2 only; version 2.0.1_rc3 only; version 2.0.1_rc4 only; version 2.0.1_rc5 only; version 2.0.1_rc6 only; …
• Openvpn Openvpn Access Server: version 2.0.0 only; version 2.0.1 only; version 2.0.2 only; version 2.0.3 only; version 2.0.5 only; version 2.0.6 only; …

Published 2014-12-03. Last modified 2026-06-17.