CVE-2014-3856 — Vulnetix

CVE-2014-3856 PUBLISHED CVSS 7 HIGH

The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temporary file with a predictable name.

EPSS 0.04% · 11.9th percentile

Risk Scores

CVSS 3.1

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.04%

11.9th percentile

Affected Products

Vendor	Product	Versions
fishshell	fish	1.23.0
n/a	n/a	n/a

Exploit Intelligence

https://github.com/fish-shell/fish-shell/issues/1437 (circl)
https://github.com/fish-shell/fish-shell/releases/tag/2.1.1 (circl)
https://www.openwall.com/lists/oss-security/2014/04/28/4 (circl)

Timeline

Sep 24, 2019 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 17, 2022 CVE Updated
May 20, 2022 EPSS Score
Jul 12, 2022 EPSS Score
Sep 4, 2022 EPSS Score
Oct 26, 2022 EPSS Score
Dec 18, 2022 EPSS Score
Feb 9, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 2, 2023 EPSS Score

References

https://github.com/fish-shell/fish-shell/issues/1437 url
https://github.com/fish-shell/fish-shell/releases/tag/2.1.1 url
https://www.openwall.com/lists/oss-security/2014/04/28/4 url
https://nvd.nist.gov/vuln/detail/CVE-2014-3856 advisory

Open in Interactive Console →