CVE-2014-3219 fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (3) /tmp/.yum-cache.$USER, or (4) /tmp/.rpm-cache.$USER.
HighCVSS 7.8
EPSS 0.43%
- Published
- Updated
- Exploit status
- No public exploit known
Description
fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (3) /tmp/.yum-cache.$USER, or (4) /tmp/.rpm-cache.$USER.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/fish(Debian:12) | < 2.1.1-1 | 2.1.1-1 |
| debian/fish(Debian:13) | < 2.1.1-1 | 2.1.1-1 |
| debian/fish(Debian:14) | < 2.1.1-1 | 2.1.1-1 |
| fishshell fish | < 2.1.1 | 2.1.1 |
| fedoraproject fedora | = 19 | No fix listed |
References
- Debian Security Tracker CVE-2014-3219 vendor-advisory
- FEDORA-2014-5783 third-party-advisory vendor-advisory
- openSUSE-SU-2019:2177 vendor-advisory
- openSUSE-SU-2019:2188 vendor-advisory
- GLSA-201412-49 third-party-advisory vendor-advisory
- [oss-security] 20140506 Re: Upcoming security release of fish 2.1.1 mailing-list patch third-party-advisory
- [oss-security] 20140928 Security release of fish shell 2.1.1 mailing-list patch third-party-advisory
- 67115 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking patch third-party-advisory vdb-entry
- github.com patch third-party-advisory
- github.com third-party-advisory
- bugs.debian.org issue-tracking