PT-2014-1915 · Fish+1 · Fish+1

Zanchey · Publicado 2014-05-02 · Atualizado 2024-06-15 · CVE-2014-2905

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions fish versions 1.16.0 through 2.1.0

Description The issue is related to improper credential checking, allowing local users to gain privileges. This is connected to the /tmp/fishd.socket.user permissions and the universal variable socket. The exploitation of this issue can lead to a breach of confidentiality, integrity, and availability of protected information. It can be exploited locally.

Recommendations For fish versions 1.16.0 through 2.1.0, update to version 2.1.1 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2015-09782

CVE-2014-2905

MGASA-2014-0404

OPENSUSE-SU-2019:2177-1

OPENSUSE-SU-2019:2188-1

OPENSUSE-SU-2019_2177-1

OPENSUSE-SU-2019_2188-1

OPENSUSE-SU-2024:10348-1

Produtos afetados

Suse

Fish

Referências · 34

• https://github.com/fish-shell/fish-shell/issues/1436 · Nota
• https://bdu.fstec.ru/vul/2015-09782 · Nota de Segurança
• https://suse.com/security/cve/CVE-2014-2906 · Nota
• https://osv.dev/vulnerability/CVE-2014-2905 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2014-0404.html · Nota de Segurança
• https://lists.opensuse.org/archives/list/[e-mail]/thread/3XMUPRUMZVMHTIGMFKMR5QUFUP4OTEOW · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2019:2177-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-3856 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00059.html · Aviso do Fabricante
• http://fishshell.com/release_notes.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2905 · Nota de Segurança
• https://lists.fedoraproject.org/pipermail/package-announce/2014-May/132618.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-2914.html · Nota
• https://suse.com/security/cve/CVE-2014-3856.html · Nota
• https://suse.com/security/cve/CVE-2014-3219 · Nota