Lucene search
HistoryMay 02, 2014 - 2:55 p.m.
CVE-2014-2905
cve-2014-2905
fish-shell
local user
gain privileges
universal variable socket
/tmp/fishd.socket.user
permissions
8.8 High
AI Score
Confidence
High
6.9 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:C/I:C/A:C
0.0004 Low
EPSS
Percentile
5.3%
fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the universal variable socket, related to /tmp/fishd.socket.user permissions.
| CPE | Name | Operator | Version |
|---|---|---|---|
| fishshell:fish | fishshell fish | eq | 1.16.0 |
| fishshell:fish | fishshell fish | eq | 2.0.0 |
Related
prion
prion
Design/Logic Flaw
2014-05-02 14:55:00
ubuntucve
ubuntucve
CVE-2014-2905
2014-05-02 00:00:00
debiancve
debiancve
CVE-2014-2905
2014-05-02 14:55:00
nessus
nessus
Fedora 19 : fish-2.1.0-11.fc19 (2014-9402)
2014-08-23 00:00:00
Fedora 20 : fish-2.1.0-11.fc20 (2014-9407)
2014-08-23 00:00:00
Fedora 20 : fish-2.1.0-9.fc20 (2014-5794)
2014-05-06 00:00:00
fedora
fedora
[SECURITY] Fedora 19 Update: fish-2.1.0-11.fc19
2014-08-23 01:54:14
[SECURITY] Fedora 20 Update: fish-2.1.0-11.fc20
2014-08-23 01:59:55
[SECURITY] Fedora 20 Update: fish-2.1.0-9.fc20
2014-05-06 03:36:35
openvas
openvas
Fedora Update for fish FEDORA-2014-9402
2014-08-23 00:00:00
Fedora Update for fish FEDORA-2014-9407
2014-08-23 00:00:00
Fedora Update for fish FEDORA-2014-5794
2014-05-12 00:00:00
gentoo
gentoo
fish: Multiple vulnerabilities
2014-12-28 00:00:00
mageia
mageia
Updated fish package fixes multiple security vulnerabilities
2014-10-09 18:06:16
freebsd
freebsd
fish -- local privilege escalation and remote code execution
2014-09-28 00:00:00
suse
suse
Security update for fish3 (moderate)
2019-09-25 00:00:00
Security update for fish3 (moderate)
2019-09-24 00:00:00
8.8 High
AI Score
Confidence
High
6.9 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:C/I:C/A:C
0.0004 Low
EPSS
Percentile
5.3%
Related for CVE-2014-2905