cbcvebase.
CVE-2014-7817
published 2014-11-24

CVE-2014-7817: The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary…

medium4.6CVSS 3.1
AVLACLAuNCPIPAP
The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".

Affected

14 ranges
VendorProductVersion rangeFixed in
canonicalubuntu_linux——
canonicalubuntu_linux——
canonicalubuntu_linux——
canonicalubuntu_linux——
debiandebian_linux——
debianglibc< glibc 2.19-14 (bookworm)glibc 2.19-14 (bookworm)
eglibceglibc>= 0 < 2.19-0ubuntu6.42.19-0ubuntu6.4
gnuglibc——
gnuglibc>= 0 < 2.19-142.19-14
gnuglibc>= 0 < 2.19-142.19-14
gnuglibc>= 0 < 2.19-142.19-14
gnuglibc>= 0 < 2.19-142.19-14
opensuseopensuse——
opensuseopensuse——

CVSS provenance

nvd4.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv5.0MEDIUM