CVE-2014-2905 — Fish vulnerability
Severity
6.9MEDIUMNVD
EPSS
0.0%
top 89.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 2
Latest updateMay 13
Description
fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the universal variable socket, related to /tmp/fishd.socket.user permissions.
CVSS vector
AV:L/AC:M/C:C/I:C/A:CExploitability: 3.4 | Impact: 10.0
Affected Packages3 packages
🔴Vulnerability Details
2📋Vendor Advisories
1Debian▶
CVE-2014-2905: fish - fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credential...↗2014